Realtek Jungle SDK Exploit Attempts Deliver Cling Botnet with STUN-Based C2

Threat actors have been observed attempting to exploit a now-patched critical security flaw impacting the Realtek Jungle software development kit (SDK) to deploy a botnet malware called Cling. According to a report from Nozomi Networks, Cling is notable not because it introduces a new propagation technique, but because it repurposes ordinary STUN (Session Traversal Utilities for NAT) behavior into a practical command-and-control channel. The exploitation attempts target users of the Realtek Jungle SDK. Nozomi Networks researchers highlighted that the malware leverages STUN protocol mechanics for C2 communications, which can evade traditional network security controls. The vulnerability has been addressed; users should update to the latest Realtek Jungle SDK version to mitigate the risk of exploitation.