ClingSTUN Linux Backdoor Exploits 24 Flaws to Turn IoT Devices Into Proxy Nodes
A new Linux backdoor named ClingSTUN abuses known vulnerabilities in Internet of Things hardware to create a covert proxy network using legitimate STUN servers.
Key points
- The ClingSTUN malware exploits 24 known vulnerabilities to compromise IoT devices.
- Compromised systems are converted into proxy nodes to obscure malicious communications.
- The threat actor leverages legitimate public STUN servers to blend in with normal traffic.
A Linux backdoor known as ClingSTUN is currently being used to exploit Internet of Things devices, turning compromised hardware into proxy nodes for attackers. According to a report by Dark Reading, the malware leverages 24 known flaws to gain access to vulnerable systems.
The primary function of ClingSTUN is to establish a covert communication channel that hides the true origin of malicious traffic. Once the backdoor is installed on an IoT device, it utilizes legitimate public STUN (Session Traversal Utilities for NAT) servers to relay data. By routing communications through these standard infrastructure components, the attackers make it difficult for security tools to distinguish between normal network operations and malicious activity. This technique effectively obscures the source of the attack, adding a layer of anonymity to the proxy network.
Context and Background
STUN servers are standard components in modern networking, designed to help applications traverse Network Address Translation (NAT) boundaries. They are commonly used in voice over IP, video conferencing, and peer-to-peer applications to determine public IP addresses and port mappings. Because STUN traffic is expected and ubiquitous in many networks, using STUN servers as a proxy mechanism is an effective evasion tactic.
The ClingSTUN variant specifically targets Linux-based IoT devices. These devices often run embedded operating systems and may lack robust security controls, making them attractive targets for inclusion in botnets or proxy networks. The malware does not appear to create new vulnerabilities; instead, it relies on existing, known flaws that have likely been publicly disclosed. The reliance on 24 distinct known vulnerabilities suggests that the attackers are casting a wide net, scanning for any device that has not been patched against previously identified issues.
Who Is Affected
Organizations and individuals using Linux-based IoT devices are at risk if those devices contain any of the 24 exploited vulnerabilities. The report indicates that the malware targets devices capable of running Linux, which includes a wide range of hardware from smart home appliances to industrial controllers. Because the attack vector depends on known flaws, any unpatched device matching the criteria is a potential target.
The use of legitimate STUN servers means that network monitoring tools configured to allow standard STUN traffic may inadvertently permit the malicious proxy communications to pass undetected. Security teams relying solely on protocol whitelisting for STUN may miss this activity, as the traffic appears structurally similar to legitimate sessions.
What should you do?
Security professionals should review their network logs for unusual STUN traffic patterns, particularly from IoT devices that do not typically require STUN functionality. Inventory management is critical; organizations must identify all Linux-based IoT devices on their networks and verify their patch status against known vulnerabilities. Since the malware exploits known flaws, applying available security updates is the most direct method of mitigation.
What to do and how to stay safe: ClingSTUN
- Audit all Linux-based IoT devices on the network to identify those running outdated firmware or unpatched software.
- Monitor network traffic for STUN protocol usage originating from devices that do not have a legitimate need for NAT traversal.
- Apply security patches immediately for any of the 24 known vulnerabilities referenced in the threat report, once the vendor provides an update.
- Segment IoT devices from critical network infrastructure to limit the potential impact if a device is compromised.
Step-by-step guide: Social Engineering Warning Signs and How to Respond
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is ClingSTUN?
ClingSTUN is a Linux backdoor that exploits known vulnerabilities in IoT devices to turn them into proxy nodes.
How does ClingSTUN hide its activity?
It uses legitimate public STUN servers to relay communications, obscuring the source of the malicious traffic.
How many vulnerabilities does ClingSTUN exploit?
The malware exploits 24 known flaws to compromise target devices.
Is there a specific patch for ClingSTUN?
The malware exploits known vulnerabilities, so standard security patches for those flaws are required; no specific "ClingSTUN" patch is mentioned, but vendors should provide updates for the underlying issues.
