Reported by 13 outlets
Linux Backdoor Abuses STUN Protocol, Exploits Dozens of Flaws
Why this score
- Breadth
- 2.00 / 2.0 · 13 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 5.00 / 5.0 · CVSS + KEV signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.02 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.2 / 10 = base × recency + community
Desk analysis
Fortinet and Nozomi Networks Labs have independently documented Cling, a Linux backdoor and botnet targeting routers, DVRs and other internet-facing embedded devices, whose defining trick is command and control disguised as STUN traffic, including packets crafted to look like they come from Google's public STUN infrastructure. Because STUN is the ordinary protocol for NAT traversal behind real-time communications, the beaconing blends into background noise that almost nobody inspects. Fortinet's writeup describes binding requests roughly every five seconds to 13 hardcoded servers, with commands delivered back through the STUN channel.
The entry point is unpatched vulnerability exploitation, led by CVE-2021-35394, the command injection in the Realtek Jungle SDK's UDPServer component disclosed in 2021. That flaw has a long tail: Unit 42 counted over 134 million exploit attempts by the end of 2022 and supply-chain exposure across 190 device models from 66 vendors, and Fortinet later reported daily exploitation still exceeding 6,000 devices. The Hacker News coverage of the current campaign confirms actors are still exploiting the patched Realtek flaw to deploy Cling, meaning the installed base of never-updated consumer and SOHO hardware remains the target pool.
The operational concern is persistence, not theft. A botnet with stealth C2 on tens of thousands of home and small-office gateways is a platform for DDoS, proxying and lateral access into any network that trusts those devices.
Watch for additional vendors reporting STUN-based C2 variants, exploitation counts for the remaining vulnerable Realtek-based devices, and whether detection guidance for unexpected STUN traffic makes it into router and firewall product defaults.
Timeline
-
update from cve.org
CVE-2021-35394: Realtek Jungle SDK Remote Code Execution Vulnerability
cve.org · 1885d ago · August 16th, 2021
MITRE published the CVE record on Aug 16, 2021, describing arbitrary command injection in Realtek Jungle SDK's UDPServer diagnostic component (versions v2.x through v3.4.14B). The advisory links to Realtek's own security notice and original researcher disclosure, confirming the vulnerability affects embedded IoT routers and access points that compile the binary as UDPServer.
-
update from paloaltonetworks.com
Palo Alto Networks Unit 42: Realtek SDK Vulnerability Exploitation (134 million attempts)
paloaltonetworks.com · 1359d ago · January 24th, 2023
Unit 42 reported that between Aug and Oct 2022, over 40% of all observed attacks targeted CVE-2021-35394, reaching 134 million exploit attempts by Dec 2022. The research documented Mirai-family payload delivery, new RedGoBot DDoS botnet samples, and supply-chain impact across 190 device models from 66 vendors.
-
update from fortinet.com
FortiGuard Labs: Realtek Jungle SDK Still Actively Exploited (upwards of 6,000 devices per day)
fortinet.com · 1303d ago · March 21st, 2023
Fortinet's Mar 2023 threat signal reported sustained exploitation of CVE-2021-35394, with daily counts exceeding 6,000 affected devices. The report links the vulnerability to active botnet campaigns including Moobot and confirms the arbitrary command injection in the MP Daemon binary remains a high-volume entry point for IoT malware.
-
update from www.nozominetworks.com
(nozominetworks.com) Cling Botnet: Exploiting STUN Protocol for Stealthy Command and Control via IoT Vulnerabilities In brief - This article
www.nozominetworks.com · 12d ago · October 1st, 2026
(nozominetworks.com) Cling Botnet: Exploiting STUN Protocol for Stealthy Command and Control via IoT Vulnerabilities In brief - This article
via Mastodon https://www.nozominetworks.com/blog/a-stunning-disguise-cling-malware-masquerades-as-google-
-
update from gbhackers.com
Cling Malware Masquerades as Google STUN Traffic to Control Compromised IoT Devices
gbhackers.com · 10d ago · October 3rd, 2026
A newly identified IoT botnet, Cling, disguises its command-and-control communications as legitimate STUN traffic, including packets that appear to originate from Google’s public STUN infrastructure. The technique enables attackers to manage compromised internet-facing devices while blending activity into routine NAT-traversal traffic used by real-time communications platforms. Nozomi Networks Labs discovered the campaign while investigating a […] The post Cling Malware Masquerades as Google STUN Traffic to Control Compromised IoT Devices appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
update from thehackernews.com
🤖 Realtek Jungle SDK flaw (now patched) exploited in the wild to drop Cling, a botnet that hides C2 traffic inside ordinary STUN requests. N
thehackernews.com · 8d ago · October 5th, 2026
🤖 Realtek Jungle SDK flaw (now patched) exploited in the wild to drop Cling, a botnet that hides C2 traffic inside ordinary STUN requests.
-
mentioned by www.fortinet.com
(fortinet.com) ClingSTUN: Linux Backdoor Exploiting Unpatched Vulnerabilities and Abusing STUN Infrastructure for Persistent Access In brief
www.fortinet.com · 8d ago · October 5th, 2026
-
mentioned by www.fortinet.com
New. Fortinet: ClingSTUN Linux Backdoor Abuses Public STUN Infrastructure https://www. fortinet.com/blog/threat-resea rch/clingstun-linux-ba
www.fortinet.com · 8d ago · October 5th, 2026
-
update from hackread.com
⚠️📢 Hackers are exploiting 24 known vulnerabilities to install the # ClingSTUN Linux backdoor on internet-facing IoT devices, turning them i
hackread.com · 8d ago · October 5th, 2026
⚠️📢 Hackers are exploiting 24 known vulnerabilities to install the # ClingSTUN Linux backdoor on internet-facing IoT devices, turning them i
via Mastodon https://hackread.com/hackers-exploit-iot-vulnerabilities-clingstun-linux-backdoor/
-
update from www.infosecurity-magazine.com
New malicious software is targeting network equipment to hide its activity as normal email traffic. If you manage business network hardware,
www.infosecurity-magazine.com · 8d ago · October 5th, 2026
New malicious software is targeting network equipment to hide its activity as normal email traffic. If you manage business network hardware,
via Mastodon https://www.infosecurity-magazine.com/news/smtp-linux-backdoors-network-edge/
-
update from fortinet.com
Discovered Linux Backdoor Exploits STUN Protocol
fortinet.com · 8d ago · October 5th, 2026
A recently discovered Linux backdoor turns infected systems into proxies that use the Session Traversal Utilities for NAT (STUN) protocol and contains exploits for self-propagation, FortiGuard Labs reports. Dubbed ClingSTUN and functioning as a back-connect proxy backdoor, the malware targets two dozen vulnerabilities for initial access and sets up persistence to ensure malware execution during the boot sequence. The malware’s operators were seen indiscriminately exploiting Avtech, EnGenius, D-Link, Hytec, Ivanti, Lantronix, Linear, MeiG, Realtek, Sunhillo, Tenda, and TP-Link flaws, and appear to be expanding their portfolio with other exploits as well. Reported in October 2026.
-
mentioned by www.darkreading.com
🤖 New Linux backdoor "ClingSTUN" compromises IoT devices by chaining 24 known flaws, then tunnels C2 traffic through legitimate public STUN
www.darkreading.com · 8d ago · October 5th, 2026
-
update from gbhackers.com
ClingSTUN Malware Turns Vulnerable IoT Devices Into Persistent Remote Proxy Nodes
gbhackers.com · 8d ago · October 6th, 2026
ClingSTUN, a Linux backdoor that exploits unpatched internet-facing devices and converts them into persistent, remotely controlled proxy nodes. The malware combines startup persistence, process concealment, competitor termination, and remote command execution with legitimate STUN infrastructure to support connectivity through network address translation.
-
update from securityonline.info
The ClingSTUN backdoor hijacks unpatched IoT devices and hides in traffic to public STUN servers. Learn how it spreads and how to stop it. #
securityonline.info · 7d ago · October 6th, 2026
Learn how it spreads and how to stop it. #
via Mastodon https://securityonline.info/clingstun-backdoor/?utm_source=mastodon&utm_medium=jetpack_social
-
update from securityaffairs.com
ClingSTUN Linux backdoor abuses public STUN infrastructure
securityaffairs.com · 7d ago · October 6th, 2026
ClingSTUN # Linux # Backdoor Abuses Public STUN Infrastructure https:// securityaffairs.com/200450/unc ategorized/clingstun-linux-backdoor
via Mastodon https://securityaffairs.com/200450/uncategorized/clingstun-linux-backdoor-abuses-public-stun-infrastructure.html
-
update from gbhackers.com
Cling Botnet Spoofs Google STUN Traffic to Hide Commands Sent to Infected IoT Devices
gbhackers.com · 7d ago · October 6th, 2026
Published October 1, the research documents exploitation of exposed networking devices and a command channel designed to exploit trust in familiar infrastructure.
-
mentioned by cyber.netsecops.io
📰 "ClingSTUN" Botnet Exploits IoT Devices Using STUN Protocol for C2 New 'ClingSTUN' botnet targets routers & DVRs, exploiting flaws like CV
cyber.netsecops.io · 7d ago · October 6th, 2026
-
update from thehackernews.com
ClingSTUN Linux botnet uses STUN protocol for C2 on routers and IoT
thehackernews.com · 6d ago · October 7th, 2026
Binding requests sent approximately every 5 seconds to 13 hardcoded servers; commands delivered via the STUN infrastructure. This shows how attackers abuse standard networking protocols for persistent access in embedded and router environments. Watch for unexpected STUN traffic and router compromise indicators.
-
mentioned by thehackernews.com
Threat actors exploited a patched flaw in Realtek Jungle SDK to deploy Cling botnet malware, which uses standard STUN behavior for C&C. Stay
thehackernews.com · 5d ago · October 8th, 2026