ClingSTUN malware exploits public STUN infrastructure to covertly control internet-connected devices

A new Linux backdoor, ClingSTUN, hijacks exposed IoT and small-office devices by blending established intrusion techniques with public STUN servers, enabling stealthy command and control through NAT traversal.

ClingSTUN is a Linux backdoor that turns exposed internet-connected devices into remotely managed proxy nodes, according to FortiGuard Labs and reporting published on 5 October. The malware is notable less for any single new flaw than for the way it combines established intrusion methods with public Session Traversal Utilities for NAT, or STUN, infrastructure, allowing its traffic to resemble ordinary VoIP or WebRTC signalling.

The campaign described by FortiGuard unfolded in three distinct phases, each tied to different payload servers and a broader set of targets. According to the researchers, the earliest wave used a download host at 124.163.212.119 and exploited CVE-2022-36553 in Hytec Inter HWL-2511-SS routers. That distribution phase lasted only two days before the operator switched to 222.223.152.97, with the most recent download source observed at 118.145.196.225. Later activity expanded to EnGenius cloud services via CVE-2025-34035 and D-Link UPnP through CVE-2024-23625, before extending to devices using Realtek SDK, TP-Link Archer AX21 firmware, AVTECH cameras, Linear access-control systems and other appliances. Reporting from Infosecurity Magazine and CyberHappenings separately described the malware as a Linux-based proxy backdoor that has been tracked across these changing campaign periods.

The exploit set is wide and appears designed for opportunistic reach across embedded and small-office equipment. FortiGuard said the code also included attacks against Ivanti appliances and Tenda devices, while one of the better-known entry points, CVE-2023-1389, affects TP-Link Archer AX21 firmware and enables unauthorised command injection. CISA added that flaw to its Known Exploited Vulnerabilities catalogue on 1 May 2023, underlining how older, already documented weaknesses can still serve as effective doors into current campaigns. Cyberworldops.eu said FortiGuard attributed the initial access phase to a cluster of roughly two dozen vulnerabilities across multiple vendors.

Once inside a device, ClingSTUN deploys architecture-specific payloads for ARM, Intel 80386, MIPS R3000, PowerPC and AMD x86-64 systems. FortiGuard said the later downloader adds more aggressive housekeeping, examining mounted paths and killing processes associated with suspicious mounts or binaries under /tmp. The malware also disables watchdog timers through ioctl calls against /dev/watchdog and /dev/misc/watchdog, enumerates /proc, and terminates selected processes, including potential rivals operating from temporary directories. When it has root privileges, it copies metadata from /proc/1 into /tmp and bind-mounts that directory over its own process entry to make the running backdoor appear tied to the init process.

Persistence is built into the design. The backdoor copies itself to /root/.cling and /usr/local/bin/.cling, sets executable permissions and alters startup files such as /etc/inittab, /etc/init.d/rcS and /etc/rc.d/rc.boot so that it launches automatically after reboot. FortiGuard said the malware then clears its original command-line arguments. It binds a UDP socket to a random local port, sends standard 20-byte STUN binding requests and, in later versions, relies on multiple public endpoints to confirm that it can stay reachable through NAT. The researchers said the second iteration contacted 24 public servers and required at least half to respond, while the third reduced that list to 13 and demanded success from all of them. The malware then periodically reports its group identifier and mapped-port list, although the operators’ wider command-and-control path has not been fully verified.

Defenders are being urged to look for unusual STUN traffic alongside repeated UDP keepalives, changes to startup files, hidden .cling binaries and abnormal process mounts. FortiGuard cautioned that legitimate public STUN servers are not, by themselves, proof of compromise, which makes context essential when hunting for this kind of activity. The most practical controls remain ordinary but effective: maintain accurate asset inventories, apply firmware updates promptly and reduce direct exposure of internet-facing devices wherever possible.