ClingSTUN Linux Backdoor Exploits 24 IoT Vulnerabilities

• •ClingSTUN exploits 24 known vulnerabilities in IoT devices, turning them into proxy nodes.
• •The malware uses legitimate STUN servers to obscure its communications, complicating detection.
• •FortiGuard Labs has not identified the attackers or the extent of the infections.

Researchers from FortiGuard Labs have identified a new Linux backdoor named ClingSTUN that exploits 24 known vulnerabilities in Internet of Things (IoT) devices. This malware turns infected devices into proxy nodes, using legitimate public STUN servers to obscure communications. The vulnerabilities targeted include critical flaws from manufacturers like D-Link, Realtek, and TP-Link. ClingSTUN establishes persistence on compromised systems and can propagate itself using hardcoded exploits for seven additional vulnerabilities. The malware has been observed in multiple attack waves, with its operators expanding the list of exploited vulnerabilities over time. FortiGuard Labs has not confirmed the identity of the attackers or the number of affected devices. The use of legitimate STUN servers complicates detection, as the traffic resembles normal Internet communications. Organizations are urged to inventory their IoT devices and prioritize patching to mitigate risks.