On October 5th, Fortinet’s Fortiguard Labs disclosed a newly discovered Linux proxy malware strain, dubbed ClingSTUN. Taking advantage of known and unpatched vulnerabilities in internet-facing devices, it enables compromised IoT and edge devices to be converted into operator-controlled proxy nodes, using targeted devices to enable further malicious activity. Outbound traffic is directed at legitimate public Session Traversal Utilities for NAT (STUN) services for abuse. ClingSTUN is a high-severity threat affecting any organization with exposed devices in scope.
Campaign Occurring in Stages
The first observed delivery of ClingSTUN malware was achieved through the exploitation of CVE-2022-36553, a command injection vulnerability in Hytec Inter HWL-2511-SS routers. The ClingSTUN attack history is divided into three time periods during which the attackers used different download sources. The initial download server was accessed by exploiting devices affected by CVE-2022-36553, and was active for only two days.
The second server brought in EnGenius and D-Link UPnP command injection, exploiting two vulnerabilities at once: CVE-2025-34035 and CVE-2024-23625. This early pivot to a new download server signals the malware operator testing out what works to craft the most effective attack possible.
A Continually Growing Exploit List
By the third phase of ClingSTUN, the list of exploited vulnerabilities has grown significantly, with 24 different CVEs from 2019 to 2026 are being leveraged in ClingSTUN attacks. A wide range of devices are being targeted by these attacks, including Tenda, TP-Link, Realtek, AVTECH, Lantronix, and Sunhillo devices.
The threat of this malware goes beyond personal and home devices: the exploitation of flaws in Ivanti Connect Secure and Policy Secure puts enterprise-level remote access within the range of possible impacts. The ClingSTUN malware contains builds for different Linux architecture versions, including ARM, MIPS, PowerPC, i386, and x86-64.
Evicting Rivals and Persisting Past Reboots
This malware carries out a number of actions to establish persistence and evade detection. It disables the watchdog timer to prevent automatic device recovery and kills competing processes in /tmp and /var/tmp. Hidden copies of the malware are written to /root/.cling and /usr/local/bin/.cling and assigned executable permissions to outlive reboots and removal attempts. The targeted device then executes the malware while booting up, through inittab, rcS, and rc.boot processes.
Posing as the Init Process
ClingSTUN clears its own command-line arguments so the command line appears blank to ps and similar tools. When running as root, it copies process files from /proc/1/ to /tmp. It then bind-mounts /tmp over its own /proc entry in order to hide process information behind metadata that has been copied from PID 1. This method ensures that host inspection will return standard init metadata, rather than exposing the malware itself.
Borrowing the Internet’s NAT Plumbing
The malware sends standard 20-byte STUN binding requests from a random local port bound to an established UDP socket. In previous versions of the attack, it would query 24 public endpoints, with at least half of the requests succeeding. In the third iteration, this number was cut to 13, with every endpoint connection ensured.
ClingSTUN discovers external IP and port mappings through STUN infrastructure and keeps these maps alive to maintain network address translator (NAT) connectivity. At first glance, this traffic is indistinguishable from normal VoIP and WebRTC activity. Taking advantage of legitimate STUN infrastructure aids the malware operators and helps malicious activity blend in with regular, often necessary, traffic.
Expanding Capabilities and Stumping Researchers
Once the STUN binding exchanges are carried out, the malware intermittently sends its group identifier and list of mapped ports to the same STUN servers. Fortiguard Labs has not discovered any separate coordination server registered in this path. The operator’s method of collecting these mappings is still unverified. A 20-byte trigger packet from the operator enables further functionality, including remote command execution.
A Self-Recruiting Proxy Network
The malware contains hard-coded exploits for seven vulnerabilities in various devices that enable ClingSTUN’s self-propagation. One of these vulnerabilities, is a Realtek SDK flaw from 2014 that remains in the kit. Many types of devices are targeted and affected by ClingSTUN, including DVRs and home routers from MVPower, TBK, Linksys, and KGUARD. Each infected node becomes a launch point for the next, ensuring a rapidly-growing proxy network that keeps itself alive and active.
This factor means that protecting devices from access by other devices is an important step alongside protecting them from external actors. “When a vulnerable device cannot be remediated immediately, defenders should be able to place compensating controls around it restricting its Internet exposure, limiting what it can communicate with and closely monitoring its behavior until the vulnerability can be resolved,” according to Louis Eichenbaum, Federal CTO at ColorTokens, a San Jose, Calif.-based provider of Zero Trust microsegmentation solutions.
When the Blocklist Stops Working
One major challenge with protecting against attacks like this is that the use of legitimate infrastructure for malicious activity makes it difficult to discern what should be blocked and when. According to Fortiguard Labs, public STUN servers are not attacker-created or controlled infrastructure. Blocking these servers would break legitimate voice and video functionality on many devices.
Rather than simply blocking the legitimate infrastructure used in the attacks, STUN activity should be evaluated and weighed alongside other factors. The presence of suspicious process behavior, unexpected UDP connections, and recurring keepalive traffic from devices with no reason to send it are all signals that may indicate a ClingSTUN attack. “Security teams should investigate why a device is making those connections, rather than assume the service it contacts is malicious or compromised,” says Jason Soroko, Senior Fellow at Sectigo, a Scottsdale, Arizona-based provider of comprehensive certificate lifecycle management (CLM). “The device’s behavior matters more than whether the destination appears on a blocklist.”
Old Flaws with Old Fixes
Every entry point used in ClingSTUN attacks is a known vulnerability, many of them years old, most of them with patches available. Keeping up with patching critical vulnerabilities in devices is a fundamental part of defending against this and similar attacks. Experts also recommend maintaining an inventory of internet-facing devices and their firmware and support status. Unsupported hardware should be replaced or isolated, and unneeded services should be closed to block entry points. While ClingSTUN demonstrates new evasion techniques, the root causes of the malware’s deployment remain unchanged.
