MEDIUMMalware
Global

Tengu Botnet Reboots Compromised Linux Devices When Defenders Kill Its Process

·Source: The Hacker News

Updated:

Executive Summary

A new Mirai-derived botnet called Tengu can use a compromised Linux device's hardware watchdog to trigger a reboot when defenders kill its main process. If that happens, Tengu's other persistence mechanisms get another chance to relaunch it. Nozomi Networks Labs observed the dropper reaching its honeypots through Telnet credential brute force. Tengu supports 25 distributed denial-of-service (

Analysis

A new Mirai-derived botnet called Tengu can use a compromised Linux device's hardware watchdog to trigger a reboot when defenders kill its main process. If that happens, Tengu's other persistence mechanisms get another chance to relaunch it. Nozomi Networks Labs observed the dropper reaching its honeypots through Telnet credential brute force. Tengu supports 25 distributed denial-of-service (
Source Attribution

Originally published by The Hacker News on Jul 28, 2026.

Related Threats

MEDIUMMalware

DPRK-Linked macOS Malvertising Uses Fake Updates to Deliver Crypto-Stealing Malware

Threat actors with ties to North Korea have been attributed to a sophisticated macOS malvertising campaign that involves redirecting users to fake web pages displaying a full-screen non-existent update sequence to deliver malware as part of a new iteration of the long-running Contagious Interview campaign. The defining aspect of the attack is that bogus macOS software update screen stealthily

The Hacker News
MEDIUMMalware

Cryptohack Roundup: Triple-A, Verus-Ethereum Bridge Exploits

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/cryptohack-roundup-triple-a-verus-ethereum-bridge-exploits-image_small-1-a-32374.jpg" align=right hspace=4><b>Also: Hackers Use SparkKitty Malware to Steal Seed Phrases</b><br>This week, Triple-A wallet was compromised and Verus-Ethereum Bridge exploited, hackers used SparkKitty malware to steal seed phrases, fake IRS letters targ

Bank Info Security
MEDIUMMalware

After the Break-In: What Attackers Do Once They're Already Inside

Attackers rarely stop after gaining initial access. Huntress analyzes a real-world intrusion to show how threat actors establish persistence, disable defenses, and reshape compromised systems, and why defenders must investigate the original entry point rather than simply remove the malware. [...]

BleepingComputer