A Linux backdoor dubbed ClingSTUN is spreading through vulnerable routers, cameras and other embedded devices and uses legitimate public STUN servers to receive commands from its operators, SecurityWeek reported Monday. Fortinet's FortiGuard Labs documented the malware, which Nozomi Networks tracks under the name Cling.

What Happened

STUN, short for Session Traversal Utilities for NAT, is a protocol that helps devices behind a router discover their public IP address and port so that voice and video calls can connect. ClingSTUN sends standard STUN binding requests over UDP to public servers to learn its external address and keep NAT mappings open. After those exchanges, FortiGuard said, it periodically reports a group identifier and its list of mapped ports to the same endpoints.

According to The Hacker News, the malware polls for UDP packets in which operator commands are encoded in the STUN transaction ID field. It contacts 13 hardcoded STUN servers roughly every five seconds. One of them, at 145.249.115[.]184, returns all-zero transaction IDs, which suggests it was set up specifically to deliver commands.

RelatedCISA Orders Agencies to Fix Exploited Palo Alto Firewall and Cisco Email Gateway Flaws by Saturday

For initial access, the operators exploit about two dozen vulnerabilities in devices from vendors including Avtech, D-Link, EnGenius, Hytec, Ivanti, Lantronix, Linear, MeiG, Realtek, Sunhillo, Tenda and TP-Link. The malware also carries hardcoded exploits for seven flaws, used to spread on its own, in products from China Mobile, KGUARD, LB-LINK, Linksys, MVPower, Realtek and TBK. The oldest of those, CVE-2014-8361, affects Realtek's SDK and dates back more than a decade.

Nozomi observed a spike in attempts to exploit CVE-2021-35394, a critical flaw in the Realtek Jungle SDK, starting around Sept. 5, 2026, with some of that traffic delivering Cling payloads. Downloaders fetch builds for x86-64, ARM, i386, MIPS and PowerPC processors.

Why It Matters

Once installed, ClingSTUN works as a back-connect proxy. It can scan for and infect new targets, open TCP tunnels, relay traffic, launch denial-of-service attacks, run remote commands and kill competing malware. Compromised devices become proxy nodes that let other parties route traffic through residential and business IP addresses, which helps disguise fraud, credential attacks and intrusions.

The STUN channel is what sets the malware apart. Many networks allow STUN traffic because video conferencing and browser-based calling depend on it, and the requests go to legitimate public servers rather than an obvious attacker domain. That makes blocklists and simple domain reputation checks less effective against it.

No infection count or attribution to a specific threat actor has been published.

The Long Tail of Embedded Flaws

Most of the bugs in ClingSTUN's toolkit affect consumer and small-business hardware such as routers, DVRs and network video recorders, which are rarely patched and often stay in service long after vendors stop issuing updates. Realtek SDK flaws in particular reach many brands, because the chipmaker's reference code is reused across device makers. The same pool of old vulnerabilities has fed a string of IoT botnets over the past decade.

What to Watch

FortiGuard advises defenders to review STUN activity together with suspicious process behavior, unexpected UDP connections and recurring keepalive traffic. In practice, that means flagging STUN requests from cameras, DVRs, routers and other devices that should not be placing calls, and checking for traffic to the published STUN server indicators. Because many of the exploited bugs are years old and some affected devices no longer receive updates, retiring or isolating unsupported hardware remains the most durable fix.