ClingSTUN turns IoT devices into proxy nodes, abusing legitimate communications services to hide connections
FortiGuard Labs analyses the ClingSTUN Linux backdoor: it maintains access through unpatched connected devices and uses public STUN services to help establish connections, making some traffic resemble ordinary voice or video communications.
Source Facts
Research published on 5 October says ClingSTUN spreads through several known vulnerabilities, can turn infected devices into proxy nodes and provides remote command execution. Delayed updates, outdated firmware and unnecessary public services are key defensive priorities.
The research emphasises that abused public STUN services are not necessarily attacker-controlled infrastructure. Some coordination details for NAT traversal remain unverified. Assess process behaviour and unusual connections together; STUN traffic alone is not proof of wrongdoing.
Include routers, cameras and other connected devices in asset and update management.
Original sources
ClingSTUN Linux Backdoor Abuses Public STUN Infrastructure
Sources checked: 2026-10-26 · Prepared with SI agent assistance; articles have not been individually reviewed by a person.
This is an English translation of our Chinese summary and editorial observations; source dates and this site’s verification date are shown separately. If an original advisory changes, refer to the source.
KEEP READING
Recommended reading
IllustrationAmazon Linux updates its Docker security advisory: check container hosts and archive handling
IllustrationPHP patches and configuration follow-up: Unit 42 corrects its assessment of one intrusion's cause
Illustration