ClingSTUN Malware Abuses Legitimate Public STUN Servers to Build Covert IoT Proxy Network
Security researchers have uncovered an evolving Linux proxy backdoor named ClingSTUN that targets unpatched, internet-facing IoT and enterprise edge devices. The campaign was observed across three distinct operational phases, with the threat actors continuously expanding their exploit repertoire. Initial waves relied on a single flaw, `CVE-2022-36553` affecting Hytec Inter routers, before expanding to target `CVE-2025-34035` in EnGenius IoT cloud services and `CVE-2024-23625` in D-Link UPnP components. The malware then leveraged command injection vulnerabilities across multiple vendors, including Linear, Realtek, TP-Link, AVTECH, and D-Link hardware. By its third phase, ClingSTUN integrated an exploit catalog spanning 24 vulnerabilities, incorporating high-profile bugs such as Ivanti Connect Secure flaws `CVE-2023-46805` and `CVE-2024-21887`, alongside newer entries like `CVE-2026-36356` and `CVE-2025-67038`. Technically, ClingSTUN functions as a back-connect proxy node designed to bypass network firewalls and NAT environments. It dispatches STUN binding requests to legitimate, public STUN servers—using up to 24 servers in version two and 13 in version three—to determine its external IP address and port mappings while keeping firewall sessions alive. The compromised node periodically reports its unique group identifier and mapped ports back through these legitimate STUN channels. Because these endpoints are trusted public utilities, the outbound traffic blends seamlessly into legitimate VoIP and WebRTC traffic patterns. Upon establishing a foothold, the binary executes aggressive anti-tampering routines, killing competitor malware processes and terminating hardware watchdog timers. For persistence, ClingSTUN drops itself into standard system directories and alters host boot scripts. To evade discovery by local administrators, the malware disguises its execution footprint by spoofing process information copied directly from the host system's `init` process. The backdoor provides operators with full remote command execution and bundles seven internal exploits targeting Realtek SDKs and digital video recorders to propagate autonomously across local network segments.
Commentary
Abusing legitimate Session Traversal Utilities for NAT (STUN) infrastructure is an elegant evasion mechanism because egress filtering on UDP port 3478 or generic VoIP traffic is notoriously noisy and frequently whitelisted in corporate and residential environments. By leveraging publicly accessible STUN endpoints, the operators avoid the operational cost of maintaining dedicated, burnable command-and-control IP ranges for traversal while simultaneously frustrating classic threat-intel blocklists. Defenders who blanket-block STUN IP destinations risk breaking WebRTC collaboration tools and softphones, precisely the confusion this malware relies upon. The wide spectrum of vulnerabilities utilized—spanning from ancient D-Link and router bugs to enterprise-grade Ivanti VPN exploits—demonstrates that the operators are opportunistically hunting for compute power at the perimeter, whether it is a neglected consumer DVR or an unpatched enterprise gateway. When edge devices run embedded Linux with outdated kernels and zero endpoint detection agents, static binary disguises (like masquerading as `init`) go completely unchallenged locally. Organizations need to audit their external perimeters immediately for exposed management interfaces, particularly legacy UPnP implementations and vulnerable appliance endpoints. Network defenders should look for continuous UDP keepalive bursts from non-collaboration assets and enforce strict outbound egress controls, ensuring that edge appliances and IoT gateways are forbidden from generating outbound STUN requests unless explicitly required by their functional role.
The Quote to Remember
“ClingSTUN is another reminder that organizations cannot patch their way out of cyber risk.”
“Believing that network segmentation provides security is a flawed assumption... Visibility alone will not save you here.”