Published on July 28, 2026
Tengu Malware Runs from Memory and Masquerades as systemd-journald to Hide on Linux Devices
Severity
Medium
Detail
Cybersecurity researchers have identified Tengu, a sophisticated Mirai-based malware family targeting poorly secured Linux and Internet of Things (IoT) devices. Unlike traditional Mirai variants that primarily conduct Distributed Denial-of-Service (DDoS) attacks, Tengu includes advanced capabilities such as proxy services, device reconnaissance, payload delivery, malware removal, and multiple persistence mechanisms.
The malware primarily targets routers, IP cameras, embedded Linux systems, and other Internet-connected devices by exploiting weak Telnet credentials. Tengu employs fileless execution techniques, encrypted command-and-control (C2) communications, and process masquerading to evade detection and complicate forensic investigations.
How?
The attack begins when threat actors perform Telnet brute force attacks against Internet-facing Linux and IoT devices that use weak or default credentials. After successfully gaining access, they execute a malicious shell script that downloads an architecture-specific Tengu malware binary over HTTP and launches it on the compromised device. Once active, Tengu attempts to execute directly from memory using the Linux memfd_create function, allowing it to run without leaving a file on disk. If this feature is unavailable, it creates a temporary file in /dev/shm, deletes it from the filesystem while keeping the file descriptor open and continues executing from memory to reduce forensic evidence.
Tengu then disguises itself as the legitimate systemd-journald process by changing its displayed process name to /usr/lib/systemd/systemd-journald or Linux kernel worker names such as [kworker/0:0], making it appear as a trusted system process. It also hides its C2 server using XOR obfuscation and encrypts commands received from the C2 server with a custom ChaCha20/Poly1305-like authenticated encryption scheme. The malware establishes persistence by installing fake systemd services, init.d startup scripts and modifying other startup configurations. It also launches a watchdog process that automatically restarts the malware if it is terminated and leverages the Linux device watchdog to trigger a system reboot, allowing its persistence mechanisms to relaunch the malware automatically.
Indicator of Compromise (IoC)
The following are Indicators of Compromise (IOCs) have been identified:
| IOC Type | Indicator | Description |
| C2 IP address | 64[[.]]89[.]163[.]8 | Tengu command-and-control server. |
| C2 port | 9931 | Hardcoded C2 communication port. |
Recommendation
Organizations should adopt a layered security approach by implementing the following measures to reduce the risk of Tengu infections and mitigate the impact of its fileless execution, process masquerading, and persistence techniques:
- Disable or restrict Telnet access and replace it with secure remote administration methods such as SSH.
- Enforce strong, unique passwords on Linux and IoT devices to prevent brute-force attacks.
- Regularly update device firmware and operating systems to patch known vulnerabilities.
- Monitor for suspicious processes masquerading as systemd-journald or abnormal kernel worker process names.
- Detect anomalous use of memfd_create, execution from /dev/shm, and fileless process execution.
- Monitor outbound connections to unknown IP addresses and unusual traffic over non-standard ports.
Source