CTI · reported · 2026-10-01

Cling botnet exploits STUN protocol for IoT command and control

Full story & timeline

Actors

—

Malware / tools

Cling

Campaigns

—

CVEs

CVE-2021-35394

Victim sectors

IoTtelecommunicationseducationgaming

Geography

South KoreaUnited States

MITRE ATT&CK

T1190 Exploit Public-Facing Application Initial Access
T1071 Application Layer Protocol Command and Control
T1572 Protocol Tunneling Command and Control
T1547 Boot or Logon Autostart Execution Persistence
T1036 Masquerading Stealth
T1498 Network Denial of Service Impact

Indicators

No curated indicators tied to this case.

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: Cling Botnet STUN C2 Relay Connection
id: 929fde13-b235-428d-8ea6-c3047a6d9beb
status: experimental
description: >
    Detects network connections to 145.249.115.184, the colluding STUN
    server used by the Cling IoT botnet for command-and-control. Cling
    sends STUN Binding Requests with all-zero transaction IDs every five
    seconds and receives operator commands encoded in the 12-byte STUN
    transaction ID of spoofed responses (Nozomi Networks, October 2026).
references:
    - https://www.nozominetworks.com/blog/a-stunning-disguise-cling-malware-masquerades-as-google-
author: Tia N. List
date: 2026/10/01
tags:
    - attack.t1071
    - attack.t1572
logsource:
    category: network_connection
    product: windows
detection:
    selection_c2:
        DestinationIp: 145.249.115.184
    condition: selection_c2
falsepositives:
    - Legitimate STUN/NAT traversal traffic to this IP if it is ever repurposed
    - Investigation and scanning by threat researchers
level: medium

YARA-X raw

rule Cling_IoT_Botnet_Artifacts {
    meta:
        author = "Tia N. List"
        date = "2026-10-01"
        status = "experimental"
        description = "Cling MIPS/Linux IoT botnet artifacts: the realtek.selfrep infection tag, hidden .cling binaries dropped under /root and /usr/local/bin, and the wget.p/wget.r wrapper files used to hijack wget during propagation. Derived from case analysis (Nozomi Networks) — NOT validated against a live sample."
        reference = "https://www.nozominetworks.com/blog/a-stunning-disguise-cling-malware-masquerades-as-google-"
        falsepositives = "Custom firmware or admin tooling that legitimately references these paths; combine with STUN beaconing (all-zero transaction IDs every five seconds) before acting"
    strings:
        $tag = "realtek.selfrep" ascii nocase
        $path1 = "/root/.cling" ascii
        $path2 = "/usr/local/bin/.cling" ascii
        $wget_p = "wget.p" ascii
        $wget_r = "wget.r" ascii
    condition:
        uint32(0) == 0x464C457F and (any of ($path*) or ($tag and any of ($wget*)))
}

References

Source on GitHub