Tengu Botnet Reboots Compromised Linux Devices When Defenders Kill Its Process

A new Mirai-derived botnet called Tengu can use a compromised Linux device's hardware watchdog to trigger a reboot when defenders kill its main process. If that happens, Tengu's other persistence mechanisms get another chance to relaunch it. Nozomi Networks Labs observed the dropper reaching its honeypots through Telnet credential brute force. Tengu supports 25 distributed denial-of-service (

The article reports that the Mirai-derived Tengu botnet targets internet-facing Linux and IoT devices, uses Telnet brute-force access, supports 25 DDoS methods, and can trigger a reboot via the device watchdog if defenders kill its main process.[1][3][5] It also uses persistence and self-defense mechanisms, including relaunching from other startup paths, to keep the infection active.[1][4] RealGround analysis: this is primarily a botnet/persistence threat rather than an AI-specific incident, but it is relevant because autonomous defense and response tooling must account for anti-removal behaviors that can interfere with remediation and monitoring.