SecurityWeekpublished Oct 5, 13:00 UTC (5d ago)ingested Oct 5, 13:17 UTCby Ionut Arghire

Part of a story covered by 6 sources: “ClingSTUN Linux Backdoor Turns Vulnerable IoT Devices Into Proxies” — merged summary and timeline →

Linux Backdoor Abuses STUN Protocol, Exploits Dozens of Flaws

highMalware exploited in the wildimportance 74

AI summary · grok-4.7

FortiGuard Labs says ClingSTUN Linux backdoor abuses STUN and exploits dozens of device flaws to spread.

FortiGuard Labs described ClingSTUN, a Linux back-connect proxy backdoor that abuses public STUN servers to learn external IP addresses and port mappings. Operators were seen indiscriminately exploiting vulnerabilities in Avtech, EnGenius, D-Link, TP-Link, Ivanti, Realtek, Tenda, and other device vendors, and the malware hardcodes exploits for seven further China Mobile, KGUARD, Linksys, LB-LINK, MVPower, Realtek, and TBK flaws to spread. Downloaders retrieve payloads for AMD x86-64, ARM, Intel 80386, MIPS R3000, and PowerPC. It kills rival processes, disables a watchdog, copies itself to hidden executables, appends commands to three init scripts, and accepts packets that trigger remote code execution and propagation.

ClingSTUN turns infected Linux and embedded devices into STUN-based back-connect proxies.
Operators exploited flaws in D-Link, TP-Link, Ivanti, Realtek, Tenda, and other vendors.
Self-propagation includes hardcoded exploits for seven additional device vulnerabilities.
It persists via hidden copies and startup commands in three initialization scripts.
Public STUN servers used for NAT mapping are not necessarily attacker infrastructure.

Read the original

VendorsAvtech EnGenius D-Link Hytec Ivanti Lantronix Linear MeiG Realtek Sunhillo

MalwareClingSTUN

OrganizationsFortiGuard Labs

ATT&CK T1190 Exploit Public-Facing Application T1105 Ingress Tool Transfer T1037.004 RC Scripts T1090 Proxy T1059 Command and Scripting Interpreter

Tags#clingstun #linux #backdoor #stun #botnet #iot #proxy #fortiguard

Full article369 words · extracted from securityweek.com · click to collapse

A recently discovered Linux backdoor turns infected systems into proxies that use the Session Traversal Utilities for NAT (STUN) protocol and contains exploits for self-propagation, FortiGuard Labs reports.

Dubbed ClingSTUN and functioning as a back-connect proxy backdoor, the malware targets two dozen vulnerabilities for initial access and sets up persistence to ensure malware execution during the boot sequence.

The malware’s operators were seen indiscriminately exploiting Avtech, EnGenius, D-Link, Hytec, Ivanti, Lantronix, Linear, MeiG, Realtek, Sunhillo, Tenda, and TP-Link flaws, and appear to be expanding their portfolio with other exploits as well.

Additionally, the backdoor includes a self-propagation mechanism containing hardcoded exploits for seven China Mobile, KGUARD, Linksys, LB-LINK, MVPower, Realtek, and TBK vulnerabilities.

The ClingSTUN backdoor relies on downloaders to fetch malware payloads for different architectures, including AMD X86-64, ARM, Intel 80386, MIPS R3000, and PowerPC.

Across three variants of the botnet, FortiGuard Labs observed the same behavior related to killing competitors’ processes, terminating a watchdog timer, setting up the persistence mechanism, and executing remote commands.

Advertisement. Scroll to continue reading.

For persistence, ClingSTUN copies itself to two hidden files with executable permissions, then appends startup commands to three system initialization scripts.

Additionally, it establishes a UDP socket, binds to a random local port, and sends standard STUN binding requests to set up endpoint connections.

“After completing the STUN binding exchanges, ClingSTUN periodically sends its group identifier and mapped-port list to the same STUN endpoints. No separate coordination-server registration was identified in this path,” FortiGuard Labs says.

The malware was also seen listening to specific packets that allow its operators to perform remote code execution and trigger the self-propagation mechanism.

“A notable feature is its abuse of legitimate public STUN servers to discover external IP addresses and port mappings, thereby helping maintain NAT connectivity. These third-party services should not be automatically classified as attacker-controlled infrastructure. Instead, defenders should assess STUN activity alongside suspicious process behavior, unexpected UDP connections, and recurring keepalive traffic,” FortiGuard Labs notes.

Linux Backdoor Abuses STUN Protocol, Exploits Dozens of Flaws

ClingSTUN Turns Vulnerable IoT Devices Into Proxy Nodes

ClingSTUN Malware Turns Vulnerable IoT Devices Into Persistent Remote Proxy Nodes

ClingSTUN Linux Backdoor Abuses Public STUN Infrastructure

ClingSTUN Backdoor Exploits Multiple IoT Vulnerabilities to Gain Persistent Remote Access

New Linux malware turns vulnerable IoT devices into proxy nodes