Cling (Malware): news timeline & CVEs

Cling Botnet Spoofs Google STUN Traffic to Hide Commands Sent to Infected IoT Devices

Cling IoT botnet hides operator commands in spoofed Google STUN replies while exploiting exposed routers and DVRs.

Nozomi Networks Labs documented Cling, an IoT botnet that hides operator commands inside spoofed Google STUN replies while exploiting exposed routers and DVRs. Propagation centers on CVE-2021-35394 in the Realtek Jungle SDK and also carries exploits for LB-LINK, Linksys, Eir, FiberHome, China Mobile, TBK, and MVPower devices. A analyzed MIPS sample persists through init scripts and a trojanized wget, then supports scanning, TCP tunneling, proxying, and denial-of-service. Operators spoofed stun.l.google.com and issued flood tasks against a South Korean ISP, a University of Chicago cluster, and two Minecraft servers; service disruptions were not independently confirmed, and Google infrastructure was not found compromised.

GBHackersOct 6, 11:15 UTC · 4d agoMalware in the wildCVE-2021-35394 CVE-2014-8361 CVE-2023-26801+5 CVEs3· 1 read

Realtek Jungle SDK Exploit Attempts Deliver Cling Botnet With STUN-Based C2

Attackers exploiting Realtek Jungle SDK flaws are deploying the Cling botnet, which hides C2 in STUN traffic.

Nozomi Networks reported a spike, beginning around 5 September 2026, in attempts to exploit the patched critical Realtek Jungle SDK flaw CVE-2021-35394 (CVSS 9.8) to install the Cling botnet. The sample also embeds command-injection and remote-code-execution logic for devices from multiple vendors, including CVE-2014-8361, CVE-2016-10372, CVE-2016-20016, CVE-2023-26801, CVE-2023-41011, CVE-2024-3721, and CVE-2025-34037. Cling persists by adding itself to SysV and BusyBox init scripts or by replacing wget, then uses public STUN servers and transaction IDs for registration and commands. Those commands support worm-like scanning, TCP tunnels, proxies, and timed denial-of-service floods, including traffic aimed at a University of Chicago address and a South Korean ISP.

The Hacker NewsOct 5, 11:46 UTC · 5d agoMalware in the wildCVE-2021-35394 CVE-2014-8361 CVE-2016-10372+5 CVEs3

Cling Malware Masquerades as Google STUN Traffic to Control Compromised IoT Devices

Cling botnet malware disguises its commands as Google STUN traffic on compromised IoT devices.

Nozomi Networks analyzed Cling, a MIPS IoT botnet that registers compromised devices and receives commands while imitating Google’s public STUN service over UDP. Infections begin on exposed appliances, including a spike in attempts against Realtek CVE-2021-35394; the examined sample also contains exploits for CVE-2014-8361, CVE-2023-26801, CVE-2024-3721, CVE-2025-34037, CVE-2016-10372, CVE-2023-41011, and CVE-2016-20016. After persisting through hidden copies and startup entries, it can download payloads, scan, open TCP tunnels, relay proxy traffic, and launch denial-of-service floods. Commands were observed aimed at an internet provider, university infrastructure, and gaming services, but no infection count or confirmed outages were reported. Researchers judged the apparent Google source addresses most likely spoofed and did not find Google’s STUN servers compromised.

Cyber Security NewsOct 5, 07:43 UTC · 5d agoMalware in the wildCVE-2021-35394 CVE-2014-8361 CVE-2023-26801+5 CVEs3· 1 read

Cling Malware Masquerades as Google STUN Traffic to Control Compromised IoT Devices

Cling, a new IoT botnet, hides command-and-control in spoofed Google STUN traffic while exploiting Realtek CVE-2021-35394.

Nozomi Networks Labs identified Cling, a MIPS IoT botnet that hides command-and-control inside STUN Binding Requests, including packets spoofed to look like Google STUN traffic. Operators exploit CVE-2021-35394, a critical unauthenticated remote code execution flaw in Realtek Jungle SDK 2.0 through 3.4.14B, then spread to LB-LINK, Linksys, FiberHome, Eir, TBK, and MVPower devices. The malware persists through init scripts and by replacing wget, and can scan, tunnel, proxy, and launch denial-of-service floods. Researchers tied a suspected operator server to 145.249.115.184 and published sample hashes and loader URLs.

GBHackersOct 3, 07:48 UTC · 7d agoMalware in the wildCVE-2021-353942· 1 read

Cling

Timeline4 articles

Related CVEsby mentions

Appears with

Cling Botnet Spoofs Google STUN Traffic to Hide Commands Sent to Infected IoT Devices

Realtek Jungle SDK Exploit Attempts Deliver Cling Botnet With STUN-Based C2

Cling Malware Masquerades as Google STUN Traffic to Control Compromised IoT Devices

Cling Malware Masquerades as Google STUN Traffic to Control Compromised IoT Devices