Tengu Botnet Exploits Linux Watchdog to Auto‑Reboot Infected Systems

Tengu botnet’s watchdog‑driven reboot mechanism

The Tengu botnet has added a stealthy persistence trick: it abuses the hardware watchdog present on many Linux‑based appliances to force a cold reboot when defenders terminate its main process. Once the system powers up, secondary launchers embedded in the firmware seize the opportunity to resurrect the malicious payload.

Security researchers at Nozomi Networks Labs first spotted the dropper after it infiltrated their honeypots via brute‑force Telnet logins. The botnet currently boasts ↑ 25 distributed denial‑of‑service vectors, ranging from UDP floods to HTTP GET storms.

“Watchdog‑enabled reboot is a game‑changer for malware persistence,” said lead analyst Maya Patel.

Analysts warn that the technique could complicate remediation efforts, especially in environments still coping with the pandemic-driven expansion of insecure IoT deployments. For broader context on botnet evolution, see Reuters.