Back Darkreading

ClingSTUN Turns Vulnerable IoT Devices Into Proxy Nodes

Darkreading • October 5, 2026

The Linux backdoor exploits 24 known flaws to compromise IoT devices and uses legitimate public STUN servers to obscure communications.

Researchers have uncovered a new Linux malware strain that exploits a growing list of known vulnerabilities in Internet of Things (IoT) devices to maintain a persistent foothold on enterprise networks.

What makes the malware especially noteworthy is its use of legitimate public STUN servers to help maintain connectivity with compromised devices, allowing the attackers to obscure their infrastructure in otherwise legitimate Internet traffic. STUN is a protocol that helps devices behind firewalls and NAT connect with each other over the Internet.

Malware Targets a Growing List of IoT Vulnerabilities

Fortinet’s FortiGuard Labs researchers identified the malware , which they have dubbed "ClingSTUN," after tracking attacks targeting at least 24 known vulnerabilities in IoT devices. The vulnerabilities affect a wide range of Internet-connected devices including routers, network equipment, surveillance systems, and industrial systems from manufacturers such as D-Link, Realtek, Ivanti, and TP-Link.

The oldest of the set is a long-patched command injection vulnerability from 2021 ( CVE-2021-36380 ) in Sunhillo SureLine surveillance data distribution software used by the FAA and other aviation authorities. The most recent is a command injection flaw from earlier this year ( CVE-2026-36356 ) that affects MeiG Smart FORGE_SLT711 devices.

FortiGuard analyst Vincent Li said threat actors were deploying ClingSTUN in multiple attack waves using a rapidly expanding list of vulnerabilities to gain access to exposed devices. In the attacks FortiGuard observed, the malware used legitimate public STUN servers as a kind of network middleman to figure out how the infected device appeared on the Internet and which ports were reachable from outside, Li wrote.

Leveraging Legitimate STUN Servers

ClingSTUN periodically sent that information back to the STUN servers. FortiGuard did not find a traditional command-and-control server involved in this process and has not determined exactly how the attackers use the connection information to communicate with infected devices. "No separate coordination-server registration was identified in this path, and how the operator obtains the external mapping and delivers control traffic through NAT remains unverified," Li said.

Once installed, ClingSTUN establishes persistence on the compromised system. In addition to its persistence mechanism the malware also includes hard-coded exploits for seven additional vulnerabilities that it can use to spread from an infected device to other vulnerable IoT systems .

The flaws are separate from the 24 that enable initial access and affect devices from Realtek, MVPower, TBK, Linksys, LB-LINK, China Mobile, and KGUARD. The oldest of these vulnerabilities is CVE-2014-8361 from 2014 in a Realtek device and the most recent is CVE-2026-87827 , a remote code execution vulnerability in KGUARD DVR from earlier this year.

In to Dark Reading, Li says ClingSTUN demonstrates how vulnerable Internet-facing Linux and IoT devices can become infrastructure for malicious proxy operations. "Its use of multiple vulnerabilities for delivery highlights the importance of maintaining an accurate device inventory, reducing unnecessary Internet exposure, and promptly updating firmware and software," Li says. "Enterprises should also monitor outbound communications from these devices."

A device that ClingSTUN compromises can serve as intermediary through which an attacker can route traffic, potentially making malicious activity appear to originate from the enterprise’s public IP address. "This creates risks of IP blocklisting , reputational damage, bandwidth consumption, and operational disruption," Li points out. "Depending on routing and segmentation, the device may also provide access to internal destinations it can reach."

Mitigating the Threat

ClingSTUN's use of STUN servers can make its activity hard to distinguish from legitimate use by applications and devices that need to discover their external network mappings, Li adds. Therefore, indiscriminately blocking public STUN servers to address the ClingSTUN threat could disrupt legitimate services. Detection should therefore "focus on whether the behavior fits the device's role — for example, unexpected communication with numerous STUN endpoints, multiple UDP sockets, and recurring custom messages containing a group identifier and mapped-port list," Li says.

Li adds that organizations should identity all models and firmware versions that the vulnerabilities impact and apply vendor-supported updates promptly. In situations where an organization might not be able to update immediately, they should remove direct Internet exposure or disable the vulnerable service where operationally feasible. Li also recommends that organizations restrict access to IoT devices through trusted management networks or secure gateways with MFA, while isolating them through network segmentation and limiting inbound and outbound traffic.

John Gallagher, vice president at Viakoo, says ClingSTUN is a textbook example of how operational technology (OT) and IoT devices remain the enterprise's vulnerable soft underbelly. "Threat actors don't need new zero-days when organizations still leave known vulnerabilities unpatched on network-connected edge hardware," he says.

What makes ClingSTUN dangerous isn't just the multi-architecture exploit chain but also its living-off-the-land network camouflage, Gallagher adds. "By piggybacking on legitimate, public STUN servers, the malware makes malicious traffic look like everyday VoIP and WebRTC communications while simultaneously killing watchdogs and hiding behind root processes."

Perimeter defenses and static EDR are not sufficient because many of these devices are largely invisible to them. "Until organizations bridge the gap between vulnerability discovery and automated, at-scale firmware remediation, OT/IoT assets will remain easily compromised," Gallagher says.

Illinois-based Jai Vijayan is a veteran, award-winning technology journalist with more than 25 years of experience covering cybersecurity. His information security reporting has explored everything from ransomware, nation-state threats, and identity security to AI risk, critical infrastructure protection, software supply chain security, cloud security and emerging enterprise technologies.

Over the course of his career, Jai has written news stories, feature articles, survey reports, white papers, and e-books for enterprise and technology audiences. He has also moderated panel discussions and executive roundtables featuring CISOs, security researchers, and industry leaders.

Jai previously served as senior editor at Computerworld, where he covered information security and data-privacy issues. His work has also appeared in CSO Online, InformationWeek, The Christian Science Monitor Passcode, The Economic Times, and other publications.

His work has earned multiple industry honors, including a Joint ASBPE Excellence Award for Best Coverage of Government IT, and a Joint Jesse H. Neal Award for wireless LAN security coverage. Jai holds a Master’s degree in statistics from Bangalore University, and studied broadcasting and electronic communication at Marquette University in Milwaukee.

Want more Dark Reading stories in your Google results?

The State of Cloud Security: The Latest Challenges

How Organizations Are Managing Incident Response

How Enterprises Are Developing Secure Applications

Inside RSAC 2026: security leaders reveal the risks redefining your defense strategy

Essential News & Insights from Black Hat USA 2025

Building Cyber Resilience: Beyond Prevention to Recovery

The Frontier AI Threat: Closing the Mobile Gap in Your Exposure Management Strategy

Static Analysis, Smarter Triage, Agentic Depth: A Practical AppSec Stack for AI-Driven Development

Effective Alert Triage: Reducing Noise and Finding Real Threats

Cybersecurity Outlook 2027

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

ClingSTUN Linux Backdoor Exploits 24 IoT Vulnerabilities Researchers from FortiGuard Labs have identified a new Linux backdoor named ClingSTUN that exploits 24 known vulnerabilities in Internet of Things (IoT) devices. This malware turns infected devices into proxy nodes, using legitimate public STUN servers to obscure communications. The vulnerabilities targeted include critical flaws from manufacturers like D-Link, Realtek, and TP-Link. ClingSTUN establishes persistence on compromised systems and can propagate itself using hardcoded exploits for seven additional vulnerabilities. The malware has been observed in multiple attack waves, with its operators expanding the list of exploited vulnerabilities over time. FortiGuard Labs has not confirmed the identity of the attackers or the number of affected devices. The use of legitimate STUN servers complicates detection, as the traffic resembles normal Internet communications. Organizations are urged to inventory their IoT devices and prioritize patching to mitigate risks. 7 sources 70

Extracted Entities

ClingSTUN Turns Vulnerable IoT Devices Into Proxy Nodes

The full story

Extracted Entities

Attack Types (1)

Companies (8)

CVEs (4)

Malware (1)

MITRE ATT&CK (1)

Platforms (4)