ClingSTUN (Malware): news timeline & CVEs

New Linux malware turns vulnerable IoT devices into proxy nodes

Fortinet says ClingSTUN Linux malware exploits known IoT flaws to turn devices into STUN-backed proxy nodes.

Fortinet's FortiGuard Labs is tracking ClingSTUN, a Linux backdoor that compromises internet-facing routers, cameras, DVRs, and other IoT devices and turns them into remotely controlled proxy nodes. Attackers have exploited known command-injection, code-injection, and buffer-overflow flaws in products from Hytec, EnGenius, D-Link, TP-Link, and AVTECH, and the malware contains exploits for seven vulnerabilities. After installation it persists through init and rc scripts, hides its process, disables the watchdog, runs commands, and spreads to other devices across ARM, MIPS, PowerPC, x86, and x86-64. It blends command-and-control into legitimate public STUN traffic used by VoIP and WebRTC.

CSO OnlineOct 6, 11:49 UTC · 4d agoMalware in the wild 6 sources2· 1 read

ClingSTUN Linux Backdoor Abuses Public STUN Infrastructure

Fortinet reports ClingSTUN, a Linux IoT backdoor that hides operator traffic using public STUN servers.

FortiGuard Labs detailed ClingSTUN, a Linux backdoor that turns infected IoT devices into proxy nodes by abusing legitimate public STUN servers for NAT traversal. The campaign started with a command-injection flaw in Hytec Inter routers and later targeted devices from more than a dozen vendors, including D-Link, TP-Link, Realtek, and Linksys, plus DVR and IoT cloud platforms. A downloader installs ARM, MIPS, PowerPC, or Intel builds, persists through boot scripts, hides as PID 1, and carries exploits for seven further vulnerabilities to spread. Fortinet says the STUN servers are not compromised and urges patching of exposed devices.

Security Affairsupdated Oct 6, 11:49 UTC · 4d agofirst Oct 6, 06:31 UTC · 4d agoMalware in the wild 6 sources1

ClingSTUN Malware Turns Vulnerable IoT Devices Into Persistent Remote Proxy Nodes

ClingSTUN exploits unpatched IoT devices and turns them into persistent proxy nodes using public STUN.

FortiGuard documented ClingSTUN, a Linux backdoor that exploits unpatched internet-facing devices and turns them into persistent proxy nodes, using public STUN so traffic resembles VoIP or WebRTC. Activity expanded from Hytec Inter routers via CVE-2022-36553 to EnGenius CVE-2025-34035, D-Link UPnP CVE-2024-23625, and TP-Link Archer AX21 CVE-2023-1389, plus Realtek, AVTECH, Linear, Ivanti, and Tenda devices. Multi-architecture payloads persist through init scripts, hide as .cling, conceal process data, kill competing processes, and can propagate with seven embedded exploits. CISA added CVE-2023-1389 to the Known Exploited Vulnerabilities catalog in 2023.

GBHackersupdated Oct 6, 11:49 UTC · 4d agofirst Oct 6, 05:03 UTC · 4d agoMalware in the wild 6 sources CVE-2022-36553 CVE-2023-1389

ClingSTUN Turns Vulnerable IoT Devices Into Proxy Nodes

ClingSTUN, a Linux backdoor, exploits 24 known flaws and turns IoT devices into proxies via public STUN servers.

ClingSTUN is a Linux backdoor that compromises vulnerable IoT devices by exploiting 24 known flaws. Compromised devices are converted into proxy nodes. The malware uses legitimate public STUN servers to hide its communications. No CVE identifiers, victim names, or campaign scale were included in the report.

Dark Readingupdated Oct 6, 11:49 UTC · 4d agofirst Oct 5, 21:25 UTC · 5d agoMalware in the wild 6 sources2

ClingSTUN Malware Turns Unpatched IoT Devices Into Proxy Nodes

ClingSTUN exploits unpatched IoT flaws and uses public STUN servers to run proxy nodes.

FortiGuard Labs reported ClingSTUN, a Linux proxy backdoor observed exploiting unpatched flaws in internet-facing IoT devices and turning them into remotely controlled proxy nodes. The campaign used three phases and download servers, beginning with CVE-2022-36553 in Hytec Inter routers, then CVE-2025-34035 in EnGenius and CVE-2024-23625 in D-Link, before expanding to 24 vulnerabilities including Ivanti Connect Secure flaws CVE-2023-46805 and CVE-2024-21887 plus CVE-2026-36356 and CVE-2025-67038. ClingSTUN sends STUN binding requests to legitimate public servers so traffic resembles VoIP or WebRTC, reports mapped ports, kills competing processes, persists via boot scripts, masquerades using init process information, and supports remote command execution. It also carries exploits for seven additional vulnerabilities, including flaws in Realtek's SDK and DVR products, to spread.

Infosecurity MagazineOct 5, 14:30 UTC · 5d agoMalware in the wildCVE-2022-36553 CVE-2025-34035 CVE-2024-23625+4 CVEs4

Linux Backdoor Abuses STUN Protocol, Exploits Dozens of Flaws

FortiGuard Labs says ClingSTUN Linux backdoor abuses STUN and exploits dozens of device flaws to spread.

FortiGuard Labs described ClingSTUN, a Linux back-connect proxy backdoor that abuses public STUN servers to learn external IP addresses and port mappings. Operators were seen indiscriminately exploiting vulnerabilities in Avtech, EnGenius, D-Link, TP-Link, Ivanti, Realtek, Tenda, and other device vendors, and the malware hardcodes exploits for seven further China Mobile, KGUARD, Linksys, LB-LINK, MVPower, Realtek, and TBK flaws to spread. Downloaders retrieve payloads for AMD x86-64, ARM, Intel 80386, MIPS R3000, and PowerPC. It kills rival processes, disables a watchdog, copies itself to hidden executables, appends commands to three init scripts, and accepts packets that trigger remote code execution and propagation.

SecurityWeekupdated Oct 6, 11:49 UTC · 4d agofirst Oct 5, 13:00 UTC · 5d agoMalware in the wild 6 sources

ClingSTUN

Timeline6 articles

Related CVEsby mentions

Appears with