Fortinet Details ClingSTUN Linux IoT Proxy Backdoor

Fortinet says ClingSTUN infects Linux IoT devices via known flaws and hides proxy traffic in public STUN servers.

Fortinet’s FortiGuard Labs, in an October 5 analysis, detailed ClingSTUN, a Linux backdoor that compromises internet-facing routers, cameras, DVRs, and other IoT devices and turns them into remotely controlled proxy nodes. The campaign started with a command-injection flaw in Hytec Inter routers and later used known command-injection, code-injection, and buffer-overflow bugs across more than a dozen vendors, including D-Link, TP-Link, EnGenius, AVTECH, Realtek, and Linksys; cited identifiers are CVE-2022-36553, CVE-2025-34035, CVE-2024-23625, CVE-2023-1389, and CVE-2024-7029. A downloader installs ARM, MIPS, and PowerPC builds plus Intel binaries, which one report splits into x86 and x86-64, and the malware persists through init or rc scripts, can masquerade as PID 1, disables watchdogs, and spreads with seven built-in exploits—one account calls them seven further flaws. Operator traffic is blended into legitimate public STUN servers used by VoIP and WebRTC; Fortinet says those servers are not compromised, and a 20-byte packet can start remote commands or self-propagation. No infection count or confirmed victim list was reported, and sources differ on which vendors are named. Fortinet urges patching of exposed devices.