ClingSTUN Malware Hijacks IoT Devices Into Stealth Proxy Network

A newly discovered Linux backdoor malware is silently converting thousands of unpatched internet-facing IoT devices into remotely controlled proxy nodes, abusing legitimate public STUN servers to maintain persistent access while evading detection. Security researchers at FortiGuard Labs, who dubbed the threat ClingSTUN, warn that the campaign has expanded its exploit arsenal to 24 known vulnerabilities across a wide range of manufacturers.

How ClingSTUN Operates

ClingSTUN functions as a back-connect proxy. Once it infects a device, it sends STUN (Session Traversal Utilities for NAT) binding requests to legitimate public STUN servers to discover the device’s external IP address and port mappings. It then keeps these NAT bindings open by periodically reporting its group identifier and mapped ports back to the same servers.

The key innovation — and the reason detection is so difficult — is that STUN traffic closely resembles normal VoIP and WebRTC communications. Because the servers being contacted are legitimate infrastructure used by countless applications worldwide, traditional network monitoring tools are unlikely to flag the activity as suspicious.

Three Campaign Phases

FortiGuard tracked the campaign across three distinct periods, each marked by a shift in download servers and an expanding set of exploited vulnerabilities:

• Phase 1 — Lasted only two days, relying on a single vulnerability: CVE-2022-36553 in Hytec Inter routers.
• Phase 2 — Attackers switched to two vulnerabilities: CVE-2025-34035 in EnGenius IoT cloud service and CVE-2024-23625 in D-Link’s UPnP service. The malware also spread through command injection flaws in Linear, Realtek, TP-Link, AVTECH, and D-Link devices. STUN requests targeted 24 public servers.
• Phase 3 — The exploit list grew to 24 vulnerabilities, including Ivanti Connect Secure flaws CVE-2023-46805 and CVE-2024-21887, plus newer bugs such as CVE-2026-36356 and CVE-2025-67038. The number of STUN servers was reduced to 13.

Persistence and Stealth Mechanisms

ClingSTUN employs multiple techniques to maintain its foothold on compromised devices and avoid being removed:

• Kills competing processes and watchdog timers to prevent other malware or security tools from interfering with its operation.
• Copies itself into system locations and modifies boot scripts to ensure it restarts automatically after reboots.
• Hides behind process information copied from the system’s init process, making it appear as a legitimate system service.
• Carries hard-coded exploits for seven additional vulnerabilities, including flaws in Realtek’s SDK and three DVR products, enabling self-propagation across vulnerable networks.
• Supports remote command execution, allowing operators to run arbitrary commands on infected devices at any time.

Why IoT Devices Are Prime Targets

Internet of Things devices represent an attractive attack surface for several reasons. Many are deployed with default credentials, rarely receive firmware updates, and lack robust security monitoring. Manufacturers may discontinue support for older models, leaving known vulnerabilities permanently unpatched. The sheer volume of internet-facing IoT devices — estimated in the billions globally — provides attackers with an enormous pool of potential targets.

ClingSTUN specifically targets devices that have known but unpatched vulnerabilities. The malware’s expanding exploit list demonstrates that attackers are actively monitoring vulnerability disclosures and rapidly incorporating new entry points into their toolkit. This pattern mirrors the evolution of botnets like Mirai, which similarly leveraged IoT device weaknesses for large-scale compromise.

Detection Challenges and Recommendations

Because ClingSTUN communicates through legitimate STUN infrastructure, defenders cannot simply block STUN traffic or treat STUN servers as malicious. FortiGuard warned against treating the STUN services as attacker-controlled, noting that they are legitimate services used by many applications.

Instead, organizations should look for the following indicators of compromise:

• Suspicious processes running on IoT devices, particularly those mimicking the init process
• Unexpected UDP connections to STUN servers from devices that should not be making VoIP or WebRTC calls
• Recurring keepalive traffic at regular intervals, suggesting automated NAT binding maintenance
• Modified boot scripts or unexpected files in system directories

Preventive Measures

FortiGuard and other security experts recommend a multi-layered defense approach:

• Inventory all internet-facing devices and identify those with known vulnerabilities
• Prioritize patches for actively exploited flaws, especially those on ClingSTUN’s target list
• Replace or isolate devices that no longer receive security updates
• Implement network segmentation to limit lateral movement from compromised IoT devices
• Deploy automated firmware remediation across multivendor IoT fleets where possible
• Monitor STUN activity alongside suspicious processes and unexpected network connections

The Broader IoT Security Crisis

ClingSTUN is symptomatic of a larger problem in the IoT ecosystem. Security experts have long warned that the proliferation of connected devices with inadequate security creates a cascading risk that affects not just individual device owners but the broader internet infrastructure.

Louis Eichenbaum, federal CTO at ColorTokens, noted that organizations cannot simply patch their way out of cyber risk when it comes to IoT. He advocated for compensating controls around devices that cannot be immediately fixed, including microsegmentation to limit lateral movement.

However, John Gallagher, VP at IoT security firm Viakoo, cautioned against over-reliance on segmentation. He argued that believing network segmentation alone provides security is a flawed assumption, and instead pushed for automated firmware remediation across multivendor fleets. Visibility alone, he emphasized, will not save organizations from this class of threat.

Looking Ahead

The ClingSTUN campaign illustrates a troubling trend: malware developers are increasingly abusing legitimate infrastructure to hide their activities, making traditional detection methods less effective. The use of public STUN servers as a covert communication channel is particularly concerning because it blurs the line between normal and malicious network traffic.

As IoT device counts continue to grow and manufacturers struggle to keep pace with security updates, similar campaigns are likely to emerge. Organizations must adopt proactive device management, continuous monitoring, and rapid response capabilities to defend against this evolving threat landscape.

The key takeaway is clear: unpatched IoT devices are not just a risk to themselves — they become tools for attackers to build proxy networks that can be used for further criminal activity, including launching attacks against other targets, anonymizing malicious traffic, and providing persistent access to compromised networks. Addressing this risk requires both immediate action on known vulnerabilities and longer-term investment in IoT security infrastructure.

---

Edited by Palawan @QUE.COM
Website: https://QUE.COM Intelligence
Sponsored by: https://MAJ.COM AI Autonomous