ClingSTUN backdoor turns vulnerable Linux devices into proxies that check in through public STUN servers
FortiGuard Labs says the ClingSTUN Linux backdoor exploits two dozen flaws in a dozen vendors' gear and carries seven more to spread itself. Exploitation is indiscriminate, so any reachable vulnerable device on those lists, Ivanti's included, can join its proxy pool.
The Watch · Security desk
What happened
- The initial-access exploits hit Avtech, EnGenius, D-Link, Hytec, Ivanti, Lantronix, Linear, MeiG, Realtek, Sunhillo, Tenda and TP-Link gear, and the operators appear to be adding more.
- Downloaders fetch ClingSTUN builds for x86-64, ARM, Intel 80386, MIPS R3000 and PowerPC processors.
- All three variants FortiGuard examined kill competitors' processes, terminate a watchdog timer, set up persistence and run remote commands.
- The backdoor copies itself into two hidden executable files and appends startup commands to three system initialization scripts.
Why it matters
- What it limits constraint With no separate coordination server identified, the STUN channel offers no attacker-owned address to sinkhole, and denylisting the public STUN servers would hit legitimate services.
- What it costs cost Because the backdoor relaunches at every boot, a power cycle does not clean a device; each infection needs hands-on cleanup paid for by whoever owns the hardware.
- What it sets up precedent Three variants sharing one core and an exploit set still growing point to an operation under active development, so later builds are likely to reach devices outside today's vendor lists.
Next story · Security · Oct 6
OT coalition urges CISA to make every federal agency name an owner for OT securityConfirmed3 publishers
ClingSTUN opens a UDP socket, binds it to a random local port and sends standard STUN binding requests [7]. The servers that answer are legitimate public STUN services [10]. FortiGuard Labs said the malware abuses them "to discover external IP addresses and port mappings, thereby helping maintain NAT connectivity" [10]. Then it keeps talking to them. "After completing the STUN binding exchanges, ClingSTUN periodically sends its group identifier and mapped-port list to the same STUN endpoints. No separate coordination-server registration was identified in this path," FortiGuard Labs said [9].
In the report, STUN does two jobs for a back-connect proxy: finding the device's public address and checking it in [2][9]. SecurityWeek's account does not say the proxied traffic itself travels inside STUN packets, and it does not give CVE identifiers, an infected-device count, first-seen dates, a patch deadline or the operators' identity [1].
FortiGuard's detection advice follows from that design. "These third-party services should not be automatically classified as attacker-controlled infrastructure. Instead, defenders should assess STUN activity alongside suspicious process behavior, unexpected UDP connections, and recurring keepalive traffic," the lab said [11]. On a network, the pattern is a device with no use for STUN sending it on a timer, alongside a process its owner did not put there [9][11].
FortiGuard counts two dozen flaws used for initial access [2] and seven hardcoded into the propagation module, covering China Mobile, KGUARD, Linksys, LB-LINK, MVPower, Realtek and TBK devices [4]. The two lists add up to 31 exploits at most [14]. Realtek appears in both, so the number of distinct flaws may be lower [3][4].
Propagation starts on command. The malware listens for specific packets that let its operators execute code remotely and start the self-propagation routine [8]. Each infected device can then be turned against other vulnerable devices when the operators choose [8].
What to watch
- Publication of CVE identifiers for the exploited flaws, so owners can match them against specific device firmware versions.
- A fourth ClingSTUN variant adding exploits for vendors not on either current list.
- Any count of infected devices, or evidence of who is using the proxy capacity.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence60
- Adoption
- Not scored
- Hype gap+10
- Incentives40
- Confidence58
Perspective Coverage
3 publishers- Builder
- Builder 33%
- Operator
- Operator 57%
- Investor
- Investor 10%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
FortiGuard Labs reports that ClingSTUN, a recently discovered Linux backdoor, turns infected systems into proxies that use the STUN protocol and contains exploits for self-propagation.
- [2]
ClingSTUN functions as a back-connect proxy backdoor, targets two dozen vulnerabilities for initial access, and sets up persistence to ensure malware execution during the boot sequence.
- [3]
The malware's operators were seen indiscriminately exploiting Avtech, EnGenius, D-Link, Hytec, Ivanti, Lantronix, Linear, MeiG, Realtek, Sunhillo, Tenda and TP-Link flaws, and appear to be expanding their portfolio with other exploits.
- [4]
The backdoor's self-propagation mechanism contains hardcoded exploits for seven China Mobile, KGUARD, Linksys, LB-LINK, MVPower, Realtek and TBK vulnerabilities.
- [5]
Across three variants of the botnet, FortiGuard Labs observed the same behavior: killing competitors' processes, terminating a watchdog timer, setting up persistence and executing remote commands.
- [6]
For persistence, ClingSTUN copies itself to two hidden files with executable permissions, then appends startup commands to three system initialization scripts.
- [7]
ClingSTUN establishes a UDP socket, binds to a random local port, and sends standard STUN binding requests to set up endpoint connections.
- [8]
The malware listens for specific packets that allow its operators to perform remote code execution and trigger the self-propagation mechanism.
- [9]
"After completing the STUN binding exchanges, ClingSTUN periodically sends its group identifier and mapped-port list to the same STUN endpoints. No separate coordination-server registration was identified in this path,"
- [10]
"A notable feature is its abuse of legitimate public STUN servers to discover external IP addresses and port mappings, thereby helping maintain NAT connectivity."
- [11]
"These third-party services should not be automatically classified as attacker-controlled infrastructure. Instead, defenders should assess STUN activity alongside suspicious process behavior, unexpected UDP connections, and recurring keepalive traffic,"
- [12]
ClingSTUN relies on downloaders to fetch payloads for AMD X86-64, ARM, Intel 80386, MIPS R3000 and PowerPC architectures.
- [13]
The initial-access exploitation covers flaws from 12 vendors.
- [14]
The initial-access and propagation exploit lists total at most 31 exploits; Realtek appears in both, so distinct flaws may number fewer.
Sources
3 independent publishers whose own reporting we read for this story.
- infosecurity-magazine.comClingSTUN Malware Turns Unpatched IoT Devices Into Proxy Nodes
1 article · October 5, 2026
- securityaffairs.comClingSTUN Linux Backdoor Abuses Public STUN Infrastructure
1 article · October 5, 2026
- securityweek.comLinux Backdoor Abuses STUN Protocol, Exploits Dozens of Flaws
1 article · October 5, 2026
Topics and entities
Entities
- Fortinet
- Louis Eichenbaum
- Ivanti Connect Secure
- FortiGuard Labs