Tengu Mirai-Style Linux Bot Hides as Kernel Worker to Launch DDoS and Proxy Attacks

A newly analyzed Linux malware sample, dubbed Tengu, combines Mirai-style botnet tradecraft with broad persistence, DDoS, SSH probing, and proxy capabilities.

The stripped 32-bit ELF masquerades as a Linux kernel worker process while targeting servers, embedded devices, and IoT-adjacent systems.

It has no symbols, uses NX protection and partial RELRO, and carries a SHA-256 hash of 897226af37990fa60f25fea00b0509faa0e78d8bee10875c23b9b6ab0b8faed9.

Static analysis identified 464 functions and revealed a malware framework built to survive reboots, conceal execution, contact command-and-control infrastructure, and conduct volumetric or application-layer attacks.

Tengu explicitly uses its family name in persistence-related artifacts, including /etc/init.d/tengu. The binary also includes a table of names and paths associated with Mirai and other Linux botnets access.

That provides a solid basis for calling it Mirai-style, although the available static evidence does not establish direct source-code lineage with Mirai.

The bot’s initialization routine first improves its chances of surviving resource pressure.

It opens /proc/self/oom_score_adj and writes -1000, the Linux value that makes a process exempt from the out-of-memory killer.

This is a practical defensive measure for malware intended to remain available during DDoS operations or on memory-constrained IoT devices.

Tengu also resolves its own executable path through /proc/self/exe, stripping the (deleted) suffix if the running binary has been unlinked.

It then redirects standard input, output, and error to /dev/null, allowing it to detach quietly from the terminal.

To blend into routine system activity, the malware overwrites its argument memory with a randomized process name following the pattern kworker/%d:%d.

Although the name can mislead casual process-list inspection, defenders can still identify the userspace impostor through parent-process relationships, executable paths, command-line data, and anomalous network connections.

Reverser.Space Researchers said that, the sample, tracked as tengu_sample, is a statically linked, position-independent 32-bit x86 Linux executable measuring 198,288 bytes.

The command-and-control endpoint is concealed through runtime XOR decoding rather than stored as a readable address.

The bot decodes 64[.]89[.]163[.]8 using XOR key 0x22 and combines it with TCP port 9931.

Tengu Mirai-Style Linux Bot

Network defenders should investigate historical and active connections to this indicator, particularly from unmanaged Linux systems, internet-facing appliances, and embedded devices.

Tengu’s persistence routine is designed for heterogeneous Linux deployments. It attempts to create a systemd service described as “System Helper Service,” configured with Restart=on-failure and enabled through the multi-user.target.wants directory.

It also supports OpenWrt’s procd framework, conventional SysV init scripts, /etc/rc.d/ startup links, cron jobs using @reboot, /etc/crontab, and /etc/rc.local.

The multi-platform persistence is significant because it lets one binary operate across enterprise servers, consumer routers, and lightweight embedded distributions.

For disruptive operations, the malware contains separate raw IPv4/UDP and normal datagram-socket flooding modes.

Its raw-socket path builds IPv4 and UDP headers, calculates checksums, and can give the operator greater control over packet fields and spoofing behavior.

The datagram path offers a simpler UDP flood mechanism where raw sockets are unavailable.

This modularity aligns with DDoS techniques documented by MITRE ATT&CK, where compromised systems are used to generate high-volume traffic against designated targets.

The sample additionally contains an SSH banner and key-exchange generator. It opens TCP connections, checks responses for the SSH- banner, and sends SSH protocol data containing recognizable key-exchange, host-key, cipher, MAC, and compression algorithm lists.

This supports classification as SSH banner scanning and handshake activity, but there is no static evidence in the analyzed function of password guessing, credential theft, or a completed SSH exploitation routine.

At the application layer, Tengu can generate HTTP GET, POST, and HEAD requests with keep-alive behavior.

Another routine crafts requests containing randomized X-Forwarded-For and CF-Connecting-IP values, plus CDN-Loop: cloudflare, and references paths including /index.php and /wp-login.php.

These traits indicate an effort to create request-flood traffic while varying headers that may complicate basic log review.

The malware also includes authenticated HTTP CONNECT proxy functionality and SOCKS5 support.

It recognizes Proxy-Authorization: Basic, processes CONNECT requests, returns HTTP/1.1 200 Connection Established, and includes error responses for failed authentication or upstream connectivity.

By turning infected devices into relay nodes, operators could conceal traffic origins, proxy abusive activity, or monetize compromised hosts.

Defenders should hunt for fake kworker/ processes, unexpected startup artifacts, suspicious /tmp/.proxy.pid files, and connections to 64[.]89[.]163[.]8:9931.

Organizations should also patch exposed routers and Linux appliances, disable unused remote administration services, restrict outbound traffic from embedded systems, and monitor for unauthorized changes to systemd, init, cron, and rc.local configurations.

IOCs

Type	Indicator	Evidence
IPv4	64[.]89[.]163[.]8	Decoded from 0x10A64 to 0x10A82
TCP port	9931	Constructed from 0x10A8B to 0x10A95
Process name	[kworker/%d:%d]	Format at 0x32000; applied at 0x10B51
Init path	/etc/init.d/tengu	String at 0x33FC2; used at 0x2085D
PID file	/tmp/.proxy.pid	String at 0x32936; used at 0x15DA5
systemd description	System Helper Service	Template at 0x33C0C
SHA-256	897226af37990fa60f25fea00b0509faa0e78d8bee10875c23b9b6ab0b8faed9	Session hash metadata

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

★ Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.