Cling botnet exploits wide vulnerabilities and disguises commands in STUN traffic to target home networking devices

A new malware campaign dubbed Cling leverages multiple vulnerabilities in Realtek-based devices and conceals commands within STUN traffic, posing serious threats to home and small-office network security.

Security researchers have detailed a new botnet campaign, Cling, that is targeting home and small-office networking equipment from vendors including Linksys, TP-Link, D-Link and Tenda. According to the lead report, the malware is being used to turn compromised devices into covert proxies, allowing operators to route traffic through residential connections while masking its origin. Researchers said the campaign is not limited to one attack path or one product family, and that it continues to evolve as fresh infrastructure and exploits are added.

What makes Cling notable is the breadth of its exploit kit. The lead report says the operators are using dozens of separate vulnerabilities, including long-known flaws in Realtek-based software development kits that remain present in a wide range of devices. That includes CVE-2021-35394, a critical remote code execution weakness in the Realtek Jungle SDK, and CVE-2014-8361, an older bug in Realtek’s miniigd SOAP service that has also appeared in exploited-in-the-wild campaigns. CISA has previously listed both issues in its Known Exploited Vulnerabilities catalogue, underlining how long vulnerable devices can stay useful to attackers.

The campaign also stands out for its command-and-control design. Rather than using an obvious malware channel, Cling hides its instructions inside STUN traffic, the same protocol families used by video calls and browser-based real-time communications to get around NAT. According to the reporting, infected devices send routine-looking STUN requests to public servers, and the replies are used to deliver commands in a way that blends into normal network behaviour. That makes the traffic much harder to distinguish from legitimate use by services such as Teams, Zoom, Webex and WebRTC-based applications.

Researchers said the attackers also disguise their messages to look as though they are coming from Google’s STUN infrastructure, including stun.l.google.com. The lead report describes a technique in which the commands are packed into the STUN transaction ID field, while forged replies appear to originate from public infrastructure that many networks already trust. FortiGuard Labs said the campaign remained active and continued to change during analysis, which suggests an operator still investing effort in its development rather than a short-lived botnet run.

Once a device is compromised, Cling is built for persistence. According to the reporting from SC Media and the lead article, it copies itself into hidden locations, adds itself to boot-time scripts and, in a particularly aggressive move, replaces the normal wget binary so that later downloads are intercepted by the malware. It also attempts to conceal its process name, disables watchdog recovery functions and removes competing malware from the same host. Those measures are aimed at keeping the device available as a proxy node for as long as possible.

The devices at risk extend well beyond consumer routers. The reporting says the same Realtek software kit is used in Wi-Fi repeaters, IP cameras, smart-lighting hubs and internet-connected toys, while the exploit set in Cling also reaches network video recorders, storage appliances and some enterprise equipment. The wider implication is that a single unpatched software component can expose many product categories at once, particularly where manufacturers have stopped issuing firmware updates or have left end-of-life devices in service.

That patching problem is central to the story. Realtek fixed the underlying SDK issue in 2021, but device owners only benefit if their hardware vendor ships a corresponding firmware update, and many do not. In the meantime, attackers can keep reusing the same weakness across large numbers of still-connected products. Tom’s Hardware also reported a separate wave of router flaws affecting Asus devices, which again illustrates how exposed home networking gear remains to remote abuse when web interfaces, VPN settings or debug functions are left reachable.

For users and administrators, the practical response is straightforward: check the exact model, confirm whether support has ended and install the latest firmware if updates are still available. If the vendor no longer supports the device, replacement is the safer option, because unsupported hardware cannot be relied upon to receive security fixes. The reporting also recommends removing internet exposure from router management interfaces and blocking known malicious infrastructure where possible, although the broader lesson is that long-lived flaws in embedded software can remain exploitable for years after disclosure.