Tengu botnet hijacks Linux watchdog to reboot after process kill
Nozomi Networks discovered Tengu, a Mirai‑derived IoT botnet that triggers a hardware watchdog reboot when defenders terminate its main process. The forced reboot reactivates its hidden guardian and other persistence hooks, letting the malware regain control on compromised Linux devices. The threat spreads via Telnet credential brute‑force and supports dozens of DDoS attacks.