ClingSTUN Linux Backdoor Abuses Public STUN Infrastructure

* ClingSTUN exploits known, unpatched vulnerabilities in Internet-facing devices on Linux systems.
* The malware functions as a back-connect proxy backdoor, turning infected systems into remotely controlled proxy nodes.
* Exploitation initially involved CVE-2022-36553 in Hytec Inter HWL-2511-SS routers.
* The threat actor used multiple download sources: 124[.]163[.]212[.]119, 222[.]223[.]152[.]97, and 118[.]145[.]196[.]225.
* The malware spreads via command injections targeting devices with vulnerabilities like CVE-2025-34035 (EnGenius), CVE-2024-23625 (D-Link UPnP), and others in a list provided.
* ClingSTUN utilizes public STUN infrastructure to discover external IP addresses and port mappings.
* Persistence involves copying files to /root/.cling and /usr/local/bin/.cling, appending them to other files for boot execution, and manipulating the watchdog timer via ioctl calls on /dev/watchdog and /dev/misc/watchdog.
* It enumerates processes in /proc and binds-mounts /tmp over /proc to conceal process information.
* Remote command execution involves sending a 20-byte packet to trigger outbound TCP connections for command retrieval and execution.
* Hard-coded exploits for self-propagation include CVE-2014-8361, CVE-2016-20016, CVE-2024-7029, and others.

The narrative details a sophisticated attack methodology that seamlessly merges exploitation, C2 infrastructure leveraging public services, and deep system persistence on vulnerable IoT environments. The core pattern involves the strategic chaining of known vulnerabilities to gain an initial foothold, followed by using those compromised systems as distributed nodes. The use of legitimate STUN infrastructure for NAT traversal is a calculated move to obscure command-and-control traffic, relying on the ambiguity between standard network protocols and malicious activity.
The evolution described—moving from single vulnerability exploitation to multi-vulnerability targeting, then system-wide injection across diverse IoT vendors, and finally integrating additional exploits—suggests an adaptive adversary prioritizing broad reach over deep, focused exploits. The shift in the third download mechanism, which scans mount points and kills processes, signals a transition toward more stealthy, low-level evasion techniques designed to resist traditional endpoint monitoring.
The persistence mechanisms involving file manipulation and watchdog timer abuse reflect a focus on achieving root-level control while actively subverting system integrity checks. This suggests an adversarial goal centered not just on data exfiltration but on establishing undeniable, persistent operational control over the compromised hosts. The fact that the malware integrates specific CVEs into its propagation logic demonstrates an awareness of the current threat landscape and an effort to remain relevant by continuously mapping new entry vectors.
Bridge Questions:
How does the reliance on public STUN servers for C2 obscure the traffic sufficiently, and what monitoring techniques can reliably detect legitimate network activity versus this malicious overlay?
What are the long-term security implications when organizations must rely on patching schedules across a massive, diverse inventory of IoT devices to mitigate threats built upon such layered vulnerability exploitation?
If attackers continuously iterate through new vulnerabilities for persistence, does this indicate that current vulnerability management processes are inherently reactive rather than proactive against adaptive threat actors?