CTI · reviewed · 2026-10-06

Linux Backdoor Abuses STUN Protocol, Exploits Dozens of Flaws

Full story & timeline

MITRE ATT&CK

• T1190 Exploit Public-Facing Application Initial Access
• T1071 Application Layer Protocol Command and Control
• T1090 Proxy Command and Control
• T1543 Create or Modify System Process Persistence

Indicators

No curated indicators tied to this case.

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: Outbound STUN Traffic From a Non-Collaboration Process (ClingSTUN C2)
id: d7721659-f445-48eb-bf98-2c5e5a5246dd
status: experimental
description: >
    Detects outbound STUN traffic (UDP 3478 and the Google public STUN range
    19302) from processes that are not browsers or common collaboration/VoIP
    clients. ClingSTUN, documented by FortiGuard Labs in October 2026, is a
    Linux backdoor that turns compromised internet-facing devices into
    back-connect proxy nodes and tunnels command-and-control inside ordinary
    STUN requests to public STUN infrastructure, hiding C2 in NAT-traversal
    traffic. STUN from an unexpected process is the network-level signal the
    implant produces; on non-IoT Windows hosts this is a hunting rule for the
    same masquerading technique.
references:
    - https://www.fortinet.com/blog/threat-research/clingstun-linux-backdoor-abuses-public-stun-infrastructure
    - https://thehackernews.com/2026/10/realtek-jungle-sdk-exploit-attempts.html
    - https://securityaffairs.com/200450/uncategorized/clingstun-linux-backdoor-abuses-public-stun-infrastructure.html
author: Tia N. List
date: 2026/10/06
tags:
    - attack.t1071
    - attack.t1090
logsource:
    category: network_connection
    product: windows
detection:
    selection_stun:
        Protocol: udp
        DestinationPort:
            - 3478
            - 19302
    filter_expected:
        Image|endswith:
            - '\chrome.exe'
            - '\msedge.exe'
            - '\firefox.exe'
            - '\brave.exe'
            - '\opera.exe'
            - '\teams.exe'
            - '\slack.exe'
            - '\zoom.exe'
            - '\discord.exe'
            - '\ms-teams.exe'
    condition: selection_stun and not filter_expected
falsepositives:
    - WebRTC, VoIP, or conferencing clients not covered by the exclusion list using STUN for NAT traversal
    - Network diagnostics and NAT-traversal test tools issuing STUN binding requests
    - Security products or proxies that probe STUN reachability
level: low

References

• https://www.fortinet.com/blog/threat-research/clingstun-linux-backdoor-abuses-public-stun-infrastructure
• https://thehackernews.com/2026/10/realtek-jungle-sdk-exploit-attempts.html
• https://securityaffairs.com/200450/uncategorized/clingstun-linux-backdoor-abuses-public-stun-infrastructure.html