New Linux Botnet Masquerades as Kernel Process to Launch DDoS Attacks

Key Takeaways

• A new Linux botnet, dubbed Tengu, has been discovered, designed for stealthy operation and distributed denial-of-service (DDoS) attacks.
• Tengu malware masquerades as a legitimate Linux kernel process, making detection challenging for system administrators.
• It targets a wide range of Linux systems, including servers, embedded devices, and IoT hardware, establishing persistence through various startup mechanisms.
• The botnet employs multiple DDoS attack vectors, including raw UDP, standard datagram floods, SSH handshake activity, and HTTP request generation.

A sophisticated new Linux botnet, identified as Tengu, is actively compromising systems to build a formidable network for distributed denial-of-service (DDoS) attacks. This 32-bit malware is engineered for deep concealment, mimicking a standard kernel worker process to evade detection while establishing robust persistence across diverse Linux environments.

Tengu’s expansive toolkit poses a significant threat to a broad spectrum of devices, from enterprise servers to embedded systems and internet-of-things (IoT) devices. Beyond simple denial-of-service capabilities, Tengu integrates raw UDP and standard datagram flooding with SSH handshake manipulation, web request generation, and proxy functionalities. This multi-faceted approach allows operators to deplete target bandwidth or exhaust application resources, while infected hosts can also serve as traffic relays. The initial compromise vector for Tengu remains unconfirmed, as the analysis did not detail its delivery method.

Researchers at Reverser.space said in a report that the analyzed sample was a stripped, statically linked 32-bit Linux ELF file specifically designed for server, embedded, and IoT-adjacent operating environments. The researchers uncovered a hidden command-and-control endpoint and multiple persistence mechanisms. While the evidence strongly suggests a Mirai-style classification, the report cautions against concluding a direct code lineage.

This stealthy operation means an infected device might appear normal during a cursory inspection, only to become an active participant in a larger attack network upon receiving commands. The published analysis did not provide details on victim counts, attack volumes, or confirmed campaign impacts. Nevertheless, the combination of advanced concealment tactics, resilient startup methods, and diverse flooding routines significantly elevates the risk of difficult-to-eradicate Linux and IoT infections.

Kernel Process Masquerading

To maintain its clandestine presence, Tengu renames its visible process to a randomized, kernel-worker-style label, effectively blending in with legitimate Linux kernel processes within standard process listings. It further hardens its resilience by writing a protective value to the operating system’s out-of-memory (OOM) control, thereby reducing the likelihood of the task being terminated under memory pressure. Subsequently, it silences standard output streams and continues its operations discreetly in the background.

The bot is designed to retrieve its own executable path even if the original file has been deleted, ensuring its survival across reboots. It achieves this through various persistence mechanisms, including systemd services, SysV and OpenWrt startup scripts, scheduled tasks, and local startup files. This cross-platform persistence strategy is particularly noteworthy, echoing observations from other reports concerning Tengu operations targeting internet-facing embedded Linux devices.

The implant’s design extends beyond mere persistence. It can collect fundamental host and network information, establish authenticated HTTP CONNECT and SOCKS5 proxy capabilities, and issue HTTP GET, POST, and HEAD requests with randomized forwarding headers. These web flooding features bear resemblance to tactics observed in other IoT botnets, although the Reverser.space analysis does not establish a direct link between these threats.

DDoS Attack Capabilities

The DDoS module within Tengu operates with two distinct UDP modes. One mode generates raw IPv4 packets with attacker-controlled header fields and checksums, facilitating IP spoofing where network environments permit. The alternative mode dispatches traffic via conventional datagram sockets, serving as a fallback when raw socket access is unavailable. The malware also performs SSH banner and key-exchange handshakes; however, the review found no evidence of an authentication exploit or credential brute-forcing in this particular function.

When unleashed against a target, these modules are capable of saturating network capacity or rendering web services inaccessible. The blend of UDP, application-layer HTTP, and SSH-related activity underscores the critical need for defenders to focus on behavioral analysis rather than relying solely on static signatures. For context, investigations into other Linux botnets have similarly demonstrated how malware targeting Linux edge devices can combine flooding capabilities with proxy and access functions.

What You Should Do

• Inspect any suspicious kernel-worker-style processes by verifying their executable path and parent process.
• Monitor for unexpected modifications to out-of-memory (OOM) settings.
• Regularly review new service units, startup scripts, and tasks configured to run upon reboot.
• Implement network monitoring to flag connections to the identified command-and-control endpoint (64[.]89[.]163[.]8:9931), bursts of raw UDP traffic, unusual SSH handshakes, or HTTP requests containing randomized forwarding headers.
• Isolate suspected hosts immediately upon detection.
• Preserve all executable and network evidence for forensic analysis.
• Rotate exposed remote-access credentials promptly.
• Only remove unapproved persistence mechanisms after confirming the process is malicious and understanding its full scope.
• Patch all internet-facing devices regularly, disable unnecessary remote administration services, and monitor for repeated access attempts to reduce opportunities for botnet operators.

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.