ClingSTUN Linux Backdoor Abuses Public STUN Infrastructure

ClingSTUN is a Linux malware strain that targets IoT devices by exploiting multiple unpatched vulnerabilities across various vendors. It functions as a back-connect proxy backdoor, abusing public STUN infrastructure to maintain connectivity and NAT bindings. The malware uses advanced persistence techniques, disguises itself as the init process, terminates watchdog timers, and kills competing malware processes. It supports remote command execution and self-propagates by exploiting at least seven additional vulnerabilities. The threat actor behind ClingSTUN has evolved their tactics over time, expanding from single-vendor exploits to multi-vendor command injection attacks.

• Inside a malicious Claude Code-branded extension and its persistent SSH backdoorMalware2026-10-31
• Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFixMalware2026-09-29
• RedHook Returns with a Dangerous UpgradeMalware2026-07-09
• APT Group Expands Toolset With New GoGra Linux BackdoorMalware2026-04-22
• Leveling Up with NightSpire RansomwareMalware2026-04-08