Security News Tengu Botnet Reboots Compromised Linux Devices When Defenders Kill Its Process

[AFEH]

Content source

https://thehackernews.com/2026/07/tengu-botnet-reboots-compromised-linux.html

Tengu supports 25 distributed denial-of-service (DDoS) methods. It can also run a SOCKS5 proxy, execute shell commands, and collect system and network data. The malware can update itself and retrieve additional Executable and Linkable Format (ELF) or Android package (APK) payloads.

The analyzed sample was configured to communicate with a command-and-control (C2) server at 64[.]89.163.8 over TCP port 9931. Registration, heartbeat traffic, and command output are sent in plaintext, while server commands and updates use a custom ChaCha20/Poly1305-like authenticated encryption scheme.

URLhaus independently recorded 17 malware URLs at 64[.]89.163.8 beginning June 17, 2026. The records included a shell script, multiple ELF files tagged as Mirai, and an APK. URLhaus's most recent payload entries were first seen on July 7, and all 17 URLs were offline as of July 28.

Tengu Botnet Reboots Compromised Linux Devices When Defenders Kill Its Process

Tengu abuses Linux hardware watchdogs to reboot devices after its main process is killed, letting other persistence mechanisms relaunch it.

thehackernews.com

 

[Sampei.Nihira]

All URLs are HTTP.
Only “HTTPS Strict” resolves the issue.
It's also possible to block JavaScript for all HTTP websites.

A simpler solution is to use the 3P-Matrix-lite extension, which,even at level 2,blocks HTTP connections + all ports that can be abused (not port 443).
More info in the extension's thread.