ClingSTUN Linux Backdoor Exploits STUN Protocol and Multiple Vulnerabilities

• •ClingSTUN exploits over 24 vulnerabilities in IoT devices for remote access.
• •It uses the STUN protocol to maintain connectivity and evade detection.
• •Organizations are advised to enhance their cybersecurity practices to prevent infections.

The ClingSTUN backdoor has been identified as a Linux malware that exploits numerous vulnerabilities in Internet-facing devices, turning them into proxy nodes for remote attackers. It targets flaws in devices from manufacturers like D-Link, TP-Link, and Realtek, utilizing the STUN protocol for NAT traversal to maintain connectivity. The malware exploits at least 24 vulnerabilities for initial access and includes a self-propagation mechanism with hardcoded exploits for additional vulnerabilities. ClingSTUN establishes persistence by copying itself to hidden files and modifying system initialization scripts. The malware's traffic blends with legitimate STUN server communications, complicating detection efforts. Organizations are urged to improve their cybersecurity hygiene by applying security updates and limiting Internet exposure to mitigate risks. FortiGuard Labs has been monitoring this threat closely, emphasizing the importance of maintaining an accurate device inventory.