Cling Botnet Spoofs Google STUN Traffic to Hide Commands Sent to Infected IoT Devices
Cling IoT botnet hides operator commands in spoofed Google STUN replies while exploiting exposed routers and DVRs.
71
Vendor
Realtek
- Mentions · 7d0
- Mentions · 30d8
- All mentions9
- First seenAug 18, 2026
- Last mentioned24d ago
Timeline
9 articles · newest firstClingSTUN Linux Backdoor Abuses Public STUN Infrastructure
Fortinet reports ClingSTUN, a Linux IoT backdoor that hides operator traffic using public STUN servers.
76
ClingSTUN Malware Turns Vulnerable IoT Devices Into Persistent Remote Proxy Nodes
ClingSTUN exploits unpatched IoT devices and turns them into persistent proxy nodes using public STUN.
68
ClingSTUN Malware Turns Unpatched IoT Devices Into Proxy Nodes
ClingSTUN exploits unpatched IoT flaws and uses public STUN servers to run proxy nodes.
76
Linux Backdoor Abuses STUN Protocol, Exploits Dozens of Flaws
FortiGuard Labs says ClingSTUN Linux backdoor abuses STUN and exploits dozens of device flaws to spread.
74
Realtek Jungle SDK Exploit Attempts Deliver Cling Botnet With STUN-Based C2
Attackers exploiting Realtek Jungle SDK flaws are deploying the Cling botnet, which hides C2 in STUN traffic.
74
Cling Malware Masquerades as Google STUN Traffic to Control Compromised IoT Devices
Cling botnet malware disguises its commands as Google STUN traffic on compromised IoT devices.
68
Cling Malware Masquerades as Google STUN Traffic to Control Compromised IoT Devices
Cling, a new IoT botnet, hides command-and-control in spoofed Google STUN traffic while exploiting Realtek CVE-2021-35394.
66
Home & Small Office Wireless Routers Exploited to Attack Gaming Servers
Unit 42 details an updated Gafgyt botnet variant exploiting Zyxel, Huawei, and Realtek router vulnerabilities to recruit devices for DoS attacks on gaming servers.
38
Related CVEs
by mentions- CVE-2021-35394100%9.8Remote Code Execution via Memory Corruption in Realtek Jungle SDK
- CVE-2014-8361100%—Improper Input Validation in Realtek SDK miniigd SOAP Service Enables Remote RCE
- CVE-2025-3403791%10.0Unauthenticated OS Command Injection in Linksys E-Series Routers
- CVE-2023-2680178%9.8LB-LINK BL-AC1900_2.0 v1.0.1, LB-LINK BL-WR9000 v2.4.9, LB-LINK BL-X26 v1.2.5, and LB-LINK BL-LTE300 v1.0.8 were discovered to contain a command injection…
- CVE-2016-2001686%9.8MVPower CCTV DVR models, including TV-7104HE 1.8.4 115215B9 and TV7108HE, contain a web shell that is accessible via a /shell URI
- CVE-2016-1037282%9.8The Eir D1000 modem does not properly restrict the TR-064 protocol, which allows remote attackers to execute arbitrary commands via TCP port 7547, as…
- CVE-2023-410113%9.8Command Execution vulnerability in China Mobile Communications China Mobile Intelligent Home Gateway v.HG6543C4 allows a remote attacker to execute arbitrary…
- CVE-2024-372186%6.3TBK DVR-4104 and DVR-4216 up to 20240412 and classified as critical: This issue affects some unknown processing of the file /device.rsp?opt=sys&cmd=___S_O_S_T_R_E_A_MAX___. The manipulation of the…
- CVE-2024-2362523%9.8A command injection vulnerability exists in D-Link DAP-1650 devices when handling UPnP SUBSCRIBE messages
- CVE-2022-3655391%9.8Hytec Inter HWL-2511-SS v1.05 and below was discovered to contain a command injection vulnerability via the component /www/cgi-bin/popen.cgi
Appears with
- ClingSTUNmalware · 4
- D-Linkvendor · 4
- Nozomi Networksorganization · 4
- Hytecvendor · 4
- Clingmalware · 4
- Linksysvendor · 4
- FortiGuard Labsorganization · 3
- LB-LINKvendor · 3
- Avtechvendor · 3
- EnGeniusvendor · 3
- Realtek Jungle SDKproduct · 3
- Linearvendor · 3
- Ivantivendor · 3
- TP-Linkvendor · 3
- FiberHomevendor · 3
- MVPowervendor · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.