Cling botnet hides command traffic inside STUN protocol exchanges

Threat actors are exploiting a patched Realtek Jungle SDK flaw to deploy a botnet called Cling that disguises its command-and-control communications as ordinary STUN traffic, researchers at Nozomi Networks and Fortinet reported.

Threat actors are exploiting a critical, now-patched flaw in Realtek's Jungle SDK to deploy a botnet called Cling that hides its command-and-control traffic inside legitimate-looking STUN protocol exchanges. Security researchers at Nozomi Networks first reported the activity in early October 2026, and Fortinet published additional analysis on Oct. 5.

Attackers began targeting CVE-2021-35394, a remote code execution flaw in the Realtek Jungle SDK with a CVSS score of 9.8, around Sept. 5, 2026. The spike in exploit attempts included a subset of activity that delivered the Cling malware.

What Cling does on infected devices

Cling embeds exploit code for eight command injection and remote code execution vulnerabilities affecting routers and DVRs from multiple vendors, including Realtek, Eir, MVPower, LB-LINK, FiberHome, TBK, and Linksys devices.

The malware copies itself to /root/.cling and /usr/local/bin/.cling on infected systems. It appends both executables to /etc/inittab , /etc/init.d/rcS , and /etc/rc.d/rc.boot to establish persistence on SysV and BusyBox init systems. An alternative persistence method replaces the system's wget binary with the malware after moving the original file to another location. Any legitimate process that calls wget then triggers the malware.

STUN-based command and control

Cling uses STUN, or Session Traversal Utilities for Network Address Translation, to register infected hosts and receive operator commands. STUN helps devices behind NAT or firewalls establish peer-to-peer communications.

The malware follows a four-step process for C2 communication. It sends a STUN Binding Request to a hard-coded list of 13 STUN servers roughly every 5 seconds. The transaction ID is set to all zeros instead of a random value. It records the external ports returned in Binding Success Response messages, then sends a custom registration message to each server that includes the mapped ports and a tag indicating how the device was infected, such as realtek.selfrep or selfrep.router . The malware then polls for UDP packets that encode operator commands in the STUN transaction ID field.

Most of the 13 STUN servers are legitimate public services. The custom registration messages do not conform to the STUN protocol, so those servers drop the packets. One server, 145.249.115[.]184 , returned an all-zero transaction ID instead of echoing the original request. Nozomi Networks researchers concluded that this server is tailored to the bot's traffic and serves as the operator's command channel.

The commands arriving from this server allow operators to scan and spread the botnet, spawn or stop TCP tunnels, launch or stop proxies, and conduct denial-of-service attacks. Nozomi Networks found that command packets originate from 74.125.250[.]129 , an IP address that resolves to stun.l.google.com . The operator makes commands appear as legitimate replies from Google's public STUN service.

Denial-of-service targets

The flooding attacks observed by Nozomi Networks targeted several destinations. Targets included a South Korean ISP at 112.151.157[.]222:8080 , a University of Chicago cluster at 192.170.240[.]137:53 , and two Minecraft servers at 23.81.40[.]193:25565 and 147.185.221[.]129:25565 .

Fortinet's FortiGuard Labs published its own report on Oct. 5, 2026, naming the malware ClingSTUN. Fortinet researchers described it as a backconnect proxy backdoor that turns infected systems into remotely controlled proxy nodes. The malware discovers externally mapped IP addresses and ports through public STUN infrastructure, maintains NAT bindings, and improves connectivity between compromised hosts and remote operators. Because many of the STUN servers it contacts are legitimate public services, the resulting traffic blends with normal VoIP and WebRTC communications.

Fortinet observed additional initial access vectors beyond the Realtek flaw. The malware also targets command injection vulnerabilities in devices from D-Link, Tenda, TP-Link, Ivanti, AVTECH, EnGenius, Lantronix, MeiG, Sunhillo, Hytec Inter, Linear, and KGUARD. Cling hard-codes exploits for seven vulnerabilities including CVE-2026-87827 affecting KGUARD DVRs.

Shell script downloaders fetch malware payloads for multiple Linux architectures, including ARM, Intel 80386, MIPS R3000, PowerPC, and AMD X86-64. Once running, Cling terminates competing malware, sets up persistence, and propagates itself across the network.

What defenders should do

Organizations that operate internet-facing devices from the affected vendors should apply available firmware patches immediately. Network administrators can also block the known command-and-control IP addresses, though operators may rotate these endpoints.

Security teams reviewing network logs should look for devices contacting multiple STUN servers in rapid succession, which indicates Cling's registration phase. Unusual STUN requests with zero transaction IDs or traffic to unknown STUN servers also warrant investigation.

Vulnerability management programs should prioritize the CVEs listed in both reports for patching on internet-exposed systems. Monitoring for STUN traffic anomalies gives defenders a practical detection window before operators issue commands through the disguised channel.

Source : thehackernews.com