A newly identified Linux backdoor named ClingSTUN has been observed exploiting 24 known vulnerabilities in IoT devices. Once compromised, the devices are repurposed as proxy nodes that route malicious traffic through legitimate public STUN servers to hide command-and-control communications. The report, initially published by Dark Reading, notes that specific vulnerability details, CVE assignments, and victim counts have not been independently verified.

Which products are affected?

IoT devices with unpatched vulnerabilities (specific models not listed in the excerpt)

What should defenders do?

Security teams should prioritize patching IoT devices against the 24 exploited vulnerabilities. Network segmentation is recommended to limit the lateral movement of compromised devices. Monitoring network traffic for unusual outbound connections to STUN servers may aid in detecting potential compromise, though legitimate STUN traffic must be distinguished from malicious use. Organizations should review vendor advisories for specific patches related to the identified vulnerabilities.

highMalware

ClingSTUN Linux Backdoor Exploits 24 IoT Vulnerabilities to Create Proxy Nodes

Threat actors leverage legitimate public STUN servers to obscure C2 traffic from compromised devices

CyberIntel DeskPublished about 2 hours agoUpdated less than a minute ago1 min read

ClingSTUN Linux Backdoor Exploits 24 IoT Vulnerabilities to Create Proxy Nodes

Key Takeaways

A Linux backdoor named ClingSTUN exploits 24 known vulnerabilities in IoT devices.
Compromised devices are repurposed as proxy nodes to route traffic.
Legitimate public STUN servers are used to obscure command-and-control communications.
The report lacks independent verification of CVE assignments and victim counts.

Related Security News

highMalware

Realtek Jungle SDK Exploit Attempts Deliver Cling Botnet with STUN-Based C2

Nozomi Networks researchers report that threat actors have been attempting to exploit a critical vulnerability in the Realtek Jungle SDK. The exploitation delivers Cling botnet malware, which is notable for repurposing ordinary STUN (Session Traversal Utilities for NAT) behavior into a practical command-and-control channel. The vulnerability has since been patched. Users of the Realtek Jungle SDK are advised to update to the latest version to mitigate exploitation risk.

The Hacker Newsabout 2 hours ago1 min read