New Linux Bot 'Tengu' Evades Detection by Masquerading as Kernel Process
A new Linux botnet malware named Tengu is designed to evade detection by masquerading as a kernel process, targeting servers, embedded systems, and IoT devices with DDoS capabilities.
A new Linux botnet malware, dubbed Tengu, has emerged with a sophisticated evasion technique: it masquerades as a legitimate kernel process to remain hidden on compromised systems. This 32-bit malware targets a wide range of devices, including servers, embedded systems, and IoT devices, employing multiple persistence mechanisms to ensure its survival across various Linux configurations. Its primary function is to launch disruptive Distributed Denial of Service (DDoS) attacks, utilizing a combination of UDP floods, SSH handshake simulations, and HTTP requests.
Tengu's stealth is enhanced by its ability to replace its visible process name with a randomized kernel-worker-style label, making it appear as a routine system process in standard process listings. Furthermore, it writes a protective value to the operating system's out-of-memory control, reducing the likelihood of termination due to memory pressure. The malware also silences its standard output streams, allowing it to operate quietly in the background.
To ensure persistence, Tengu implements a robust set of survival methods. It can retrieve its own executable path even if the original file has been deleted. It then attempts to survive reboots through various mechanisms, including systemd services, SysV and OpenWrt startup scripts, scheduled tasks, and local startup files. This cross-platform approach is notable and has been observed in other Mirai-style botnets, though researchers confirm no direct code lineage with Mirai for this specific sample.
Beyond its DDoS capabilities, Tengu offers additional functionalities. It can gather basic host and network details, establish authenticated HTTP CONNECT and SOCKS5 proxy functions, and issue HTTP GET, POST, and HEAD requests with randomized forwarding headers. These web flood features, combined with its proxy capabilities, allow operators to consume bandwidth or application resources on target systems, and also use infected hosts to relay traffic.
The DDoS component of Tengu is versatile, featuring two UDP modes. One mode creates raw IPv4 packets with attacker-controlled header fields and checksums, which can support IP spoofing where the environment permits. The other mode sends traffic through ordinary datagram sockets, serving as a fallback when raw sockets are unavailable. The malware also performs SSH banner and key-exchange handshakes, though current analysis has not found evidence of an authentication exploit or credential attack within this function.
Researchers highlight that the combination of concealment, durable startup methods, and multiple flooding routines poses a significant risk of difficult-to-remove infections on Linux and IoT devices. While the exact delivery route remains unconfirmed and no specific victim count or attack volume has been publicly disclosed, the malware's design suggests a potent threat to internet-facing systems.
Defenders are advised to look for behavioral indicators rather than relying solely on signatures. This includes inspecting suspicious kernel-worker-style processes against their executable and parent process, monitoring for unexpected changes to out-of-memory settings, and reviewing new service units, startup scripts, and reboot-triggered tasks. Network monitoring should flag connections to known command-and-control endpoints and bursts of raw UDP, unusual SSH handshakes, or HTTP requests with randomized forwarding headers.
To mitigate the risk, administrators should isolate suspected hosts, preserve evidence, rotate exposed remote-access credentials, and remove unapproved persistence mechanisms after confirming malicious activity. Proactive measures such as patching internet-facing devices, disabling unnecessary remote administration, and monitoring for repeated access attempts can significantly reduce the opportunities for botnet operators to expand their networks.