ClingSTUN Linux Backdoor Abuses Public STUN Infrastructure

FortiGuard Labs has identified ClingSTUN, a sophisticated Linux malware strain targeting IoT devices through a wide array of unpatched vulnerabilities, including command injections in EnGenius, D-Link, and TP-Link products. The malware functions primarily as a back-connect proxy node, allowing attackers to maintain persistent access to internal networks. A defining characteristic of ClingSTUN is its exploitation of legitimate, public Session Traversal Utilities for NAT (STUN) infrastructure to facilitate connectivity through firewalls, blending its malicious traffic with legitimate VoIP and WebRTC communications.

The attack chain involves initial access via vulnerability exploitation, followed by a multi-stage downloader that implements aggressive anti-analysis and persistence mechanisms. ClingSTUN specifically targets Linux architectures including ARM, MIPS, and x86-64. Once established, it acts as a self-propagating worm, scanning for additional vulnerable devices using hardcoded exploits. This campaign poses a significant risk to organizations with exposed IoT hardware, as it enables remote control and long-term residency within the network.

Defenders should be aware that the use of public STUN servers is a technique to evade traditional IP-based blacklisting. Management of this threat requires rigorous patching of the extensive list of targeted CVEs, monitoring for suspicious process hiding techniques—such as bind-mounting /proc—and auditing unexpected UDP traffic to public STUN endpoints.