Tengu is a Mirai-derived botnet that compromises Linux devices via Telnet brute force. It supports 25 DDoS methods, runs a SOCKS5 proxy, executes shell commands, and collects system data. Its standout feature is abusing the hardware watchdog to reboot devices when its process is killed, allowing other persistence mechanisms to relaunch it. It also overwrites reboot/shutdown utilities with 'ELFOOD' to hinder defenders.