Analysis of Tengu: A New Threat in Linux Malware
In the evolving landscape of cybersecurity, a newly identified strain of Linux malware, named Tengu, has emerged as a significant threat. This particular malware combines sophisticated tactics reminiscent of the notorious Mirai botnet, with the ability to persistently embed itself within systems, execute Distributed Denial of Service (DDoS) attacks, probe Secure Shell (SSH) connections, and operate as a proxy.
Technical Characteristics
Tengu is characterized as a stripped 32-bit Executable and Linkable Format (ELF) file, disguising itself as a legitimate Linux kernel worker process. It primarily targets a spectrum of devices including servers, embedded systems, and Internet of Things (IoT) devices, making it a versatile threat. This malware is designed without symbols, and employs protection mechanisms like NX (No eXecute) and partial RELRO (Read-Only Relocations), enhancing its stealthy capabilities. It carries a specific SHA-256 hash of 897226af37990fa60f25fea00b0509faa0e78d8bee10875c23b9b6ab0b8faed9, which serves as a unique identifier for this malware variant.
Persistence and Functionality
Static analysis of Tengu has uncovered an impressive 464 functions, indicating a robust malware framework engineered to maintain its operation across system reboots, mask its activities, and connect to its command-and-control (C2) infrastructure. Notably, it integrates the name “Tengu” within its persistence artifacts, prominently appearing in the directory /etc/init.d/tengu. This disclosure suggests a deliberate resemblance to Mirai and other Linux-based botnets, although, as of now, static evidence does not confirm a direct lineage to Mirai’s source code.
The initialization process of Tengu takes several defensive measures to ensure its longevity. For instance, it modifies the /proc/self/oom_score_adj file, setting its value to -1000, which exempts it from being targeted by the Linux out-of-memory killer. This maneuver indicates a strategic design in malware intended to stay operational during heavy DDoS campaigns or within constrained IoT environments.
Evasion Techniques
Tengu employs various advanced techniques to avoid detection. It determines its execution path through the /proc/self/exe interface, stripping away the (deleted) suffix should the running binary be unlinked. Furthermore, it directs standard input, output, and error streams to /dev/null, preventing terminal interruptions. To evade casual scrutiny during process-list inspections, the malware modifies its argument memory to adopt a randomized process name that follows the format kworker/%d:%d. Despite these tactics, cybersecurity professionals are still able to detect the malware by analyzing parent-process relationships, executable paths, command-line arguments, and any unusual network connections.
Command-and-Control Communication
The malware sample, referred to as tengu_sample, is a compact, statically linked 32-bit x86 Linux executable measuring 198,288 bytes. One notable feature is its C2 communication, which is obfuscated through XOR decoding implementations, making its endpoint less susceptible to static analysis. For instance, the IP address 64.89.163.8 is dynamically decoded at runtime using an XOR key of 0x22, allowing the malware to connect via TCP port 9931.
Detection and Defense Measures
Given its persistence mechanisms, including the setup of a systemd service titled “System Helper Service” that is configured to restart upon failure, Tengu presents substantial challenges for defenders. It demonstrates compatibility with heterogeneous Linux deployments, making it applicable across various systems such as enterprise servers, consumer routers, and lightweight embedded distributions.
For offensive and disruptive capabilities, Tengu offers multiple flooding options, including raw IPv4/UDP sockets and standard datagram-socket methods. The inclusion of these disruptive capabilities aligns with DDoS methods outlined in MITRE ATT&CK frameworks, where compromised systems are weaponized to send overwhelming traffic to targeted victims.
Conclusion: Recommendations for Prevention
In light of Tengu’s sophisticated nature, network defenders are advised to scrutinize historical and active connections associated with this malware, particularly from unmanaged Linux systems, internet-facing appliances, and embedded devices.
Defensive strategies should include hunting for processes masquerading as kworker/, monitoring for unexpected startup artifacts, and identifying suspicious PID files like /tmp/.proxy.pid. Organizations should also take proactive measures by patching exposed routers and Linux appliances, disabling unused remote administration services, limiting outbound traffic from embedded systems, and vigilantly observing unauthorized modifications to systemd, init, cron, and rc.local configurations.
Furthermore, the cybersecurity community must stay vigilant, adapting and evolving their strategies in the face of increasingly complex threats like Tengu that exploit the vulnerabilities inherent in modern computing infrastructure. By adopting a layered defense approach, organizations can more effectively safeguard against the risks posed by this emerging malware.