Linux Backdoor Abuses STUN Protocol, Exploits Dozens of Flaws

Summary

A new Linux backdoor named ClingSTUN has been discovered that functions as a back-connect proxy. It exploits numerous vulnerabilities for initial access and self-propagation, targeting devices from various manufacturers. ClingSTUN also uses the STUN protocol to establish connections and maintain NAT connectivity, making it harder to detect as malicious infrastructure.

Full text

A recently discovered Linux backdoor turns infected systems into proxies that use the Session Traversal Utilities for NAT (STUN) protocol and contains exploits for self-propagation, FortiGuard Labs reports. Dubbed ClingSTUN and functioning as a back-connect proxy backdoor, the malware targets two dozen vulnerabilities for initial access and sets up persistence to ensure malware execution during the boot sequence. The malware’s operators were seen indiscriminately exploiting Avtech, EnGenius, D-Link, Hytec, Ivanti, Lantronix, Linear, MeiG, Realtek, Sunhillo, Tenda, and TP-Link flaws, and appear to be expanding their portfolio with other exploits as well. Additionally, the backdoor includes a self-propagation mechanism containing hardcoded exploits for seven China Mobile, KGUARD, Linksys, LB-LINK, MVPower, Realtek, and TBK vulnerabilities. The ClingSTUN backdoor relies on downloaders to fetch malware payloads for different architectures, including AMD X86-64, ARM, Intel 80386, MIPS R3000, and PowerPC. Across three variants of the botnet, FortiGuard Labs observed the same behavior related to killing competitors’ processes, terminating a watchdog timer, setting up the persistence mechanism, and executing remote commands.Advertisement. Scroll to continue reading. For persistence, ClingSTUN copies itself to two hidden files with executable permissions, then appends startup commands to three system initialization scripts. Additionally, it establishes a UDP socket, binds to a random local port, and sends standard STUN binding requests to set up endpoint connections. “After completing the STUN binding exchanges, ClingSTUN periodically sends its group identifier and mapped-port list to the same STUN endpoints. No separate coordination-server registration was identified in this path,” FortiGuard Labs says. The malware was also seen listening to specific packets that allow its operators to perform remote code execution and trigger the self-propagation mechanism. “A notable feature is its abuse of legitimate public STUN servers to discover external IP addresses and port mappings, thereby helping maintain NAT connectivity. These third-party services should not be automatically classified as attacker-controlled infrastructure. Instead, defenders should assess STUN activity alongside suspicious process behavior, unexpected UDP connections, and recurring keepalive traffic,” FortiGuard Labs notes. Related: macOS Users Targeted by Fake Zoom Installer Carrying CloudSyncD Backdoor Related: AI Agents Aimed SQL Injection at US and Canadian Government Sites Related: Russian APT Star Blizzard Uses ‘RedFlick’ Infection Chain in Recent Attacks Related: Hackers Use ChatGPT Custom GPTs in ClickFix Attacks Written By Ionut Arghire Ionut Arghire is an international correspondent for SecurityWeek. Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights. More from Ionut Arghire In Rare Move, Alleged Iranian State Hacker Extradited to USWarlock Expands SharePoint Exploitation in Critical Infrastructure AttacksExploited Fortinet FortiMail Zero-Day Calls for Urgent ActionZimbra Vulnerability Exploited in the Wild Prior to Public DisclosureZammad Zero-Days Exploited in AI-Powered DIVD Hack500,000 Active Credentials Left Exposed on GitHubCisco Patches Exploited Catalyst SD-WAN Zero-Day VulnerabilityWatchGuard Patches Critical Fireware OS Code Injection Vulnerability Latest News 250,000 Impacted by Data Breaches at New Jersey, Texas Healthcare FirmsExploitation Hits Rejetto HFS Vulnerability Discovered by AI Senate Passes Bipartisan Bill to Strengthen Healthcare CybersecurityAlleged ShinyHunters Leader Arrested in JordanExploitation of Citrix NetScaler Zero-Day Hits Appliances Patched Days EarlierTrump Names National Intelligence Director Jay Clayton to Lead a New Federal AI Task Forcedoxx.net Raises $38 Million to Prevent AI Agent-on-the-Internet MisadventuresFortra Patches Critical Vulnerabilities in BoKS Trending Daily Briefing NewsletterSubscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts. Webinar: Securing AI Agents, MCPs, and AI Automations October 7, 2026 Learn how to address potential risks and not restrict AI adoption in your organization. See what a centralized AI gateway is and how it works in practice. Register Virtual Event: Zero Trust & Identity Strategies Summit 2026 October 14, 2026 Join as we decipher the world of zero trust and share war stories on securing an organization by eliminating implicit trust and continuously validating every stage of a digital interaction. Register People on the MoveChip Wentz has been appointed as SVP & CISO at Keurig Dr Pepper Inc.Lumen Technologies has named Kim Keever as CSO.Quantum Secure Encryption Corp. has appointed Joseph Hall as CIO.More People On The MoveExpert Insights AI Has Changed Attack Speed, Not Security Fundamentals As AI accelerates vulnerability discovery and exploitation, so-called virtual patching still comes down to defense-in-depth and strong application security fundamentals. (Joshua Goldfarb) Four Cyber Threats Harboring Big Plans for the Future - AI, supply-chain exposure, quantum computing and geopolitical conflict are testing security programs. Preparing for disruption must become part of day-to-day operations. (Steve Durbin) Begin at the End: How to Enable Agentic Remediation Agentic remediation is not an act of faith. We are talking about fixing known problems, not judgment calls about unfamiliar risk. (Nadir Izrael) “We Think the Security Control Is Working” Is No Longer Good Enough Point-in-time audits and sampled assessments offer only snapshots; continuous control monitoring provides evidence that security controls are working today. (Sravish Sridhar) This Key Will Self-Destruct: An Open Standard for Revocable API Keys Every leaked credential should be dead, or dying, within sixty seconds of being found. Here's a proposal to make that the default. (Matt Honea) Flipboard Reddit Whatsapp Whatsapp Email

Indicators of Compromise

• malware — ClingSTUN

Entities