ClingSTUN Linux backdoor turns hacked devices into proxies and spreads by exploiting router and IoT vulnerabilities

Updated: 2026.10.05 15D ago 2 sources

Threat Actors & APTs Zero-Days & CVEs Malware

Researchers say a newly identified Linux backdoor called ClingSTUN is infecting devices and turning them into attacker-controlled network proxies. FortiGuard Labs says the malware abuses the STUN protocol (used to discover public IP and port mappings through network address translation) to maintain connectivity, sets boot persistence by modifying startup scripts, and includes exploit code for roughly two dozen vulnerabilities for initial access plus seven hardcoded flaws for self-propagation across products from vendors including Avtech, D-Link, EnGenius, Ivanti, Lantronix, Realtek, Tenda, and TP-Link.

Why it matters: This is a broad opportunistic malware threat against internet-exposed Linux-based edge and embedded devices, especially routers, cameras, and similar appliances. Organizations should urgently patch exposed devices from the named vendors, review unusual STUN and UDP traffic, and hunt for persistence changes in Linux startup files.

Sources

Linux Backdoor Abuses STUN Protocol, Exploits Dozens of Flaws

Ionut Arghire 2026.10.05 100% relevant

This article appears to be the first tracked report establishing ClingSTUN as a distinct malware/backdoor campaign with specific propagation and STUN-based command-and-control tradecraft.

Realtek Jungle SDK Exploit Attempts Deliver Cling Botnet With STUN-Based C2

info@thehackernews.com (The Hacker News) 2026.10.05 94% relevant

This appears to update the same underlying malware campaign by adding that exploit attempts against devices using Realtek Jungle SDK are being used to deliver the Cling botnet, with STUN-based command and control and continued targeting of router and IoT infrastructure.