TENGU BOTNET REBOOTS COMPROMISED LINUX DEVICES WHEN DEFENDERS KILL ITS PROCESS

Summary from the TLDR InfoSec newsletter

Nozomi Networks Labs identified a Mirai-derived botnet named Tengu that abuses a compromised Linux device's hardware watchdog to force a reboot whenever its main process is killed, giving its other persistence mechanisms, including a fake systemd service and immutable binaries, another chance to relaunch. The researchers stopped short of establishing the botnet's real-world scale, and independent URLhaus telemetry at the same C2 address confirmed only generic Mirai-related hosting rather than Tengu itself.