ClingSTUN Turns Vulnerable Edge Devices Into Attacker Infrastructure

ClingSTUN is a Linux malware campaign targeting vulnerable Internet-facing IoT and network edge devices by exploiting known vulnerabilities. It installs a back-connect proxy backdoor that enables persistent remote access and converts compromised devices into proxy nodes. The malware supports multiple Linux architectures and employs techniques such as boot persistence, process concealment, remote command execution, and self-propagation. It abuses public STUN infrastructure to facilitate NAT traversal. The campaign targets devices from multiple vendors including D-Link, EnGenius, Realtek, TP-Link, AVTECH, Ivanti, Tenda, and Lantronix, emphasizing risks from unpatched and exposed devices.

• ClingSTUN Linux Backdoor Abuses Public STUN InfrastructureMalware2026-10-05
• Open Directory Exposes Moobot Source Code and Ongoing Activity Post 2024 Court-Authorized DisruptionMalware2026-08-28
• Hackers Exploiting ‘SSHole’ Authentication Bypass in OpenSSHHighVulnerability2026-11-09
• Canto incognito: tracking the PoeLLM malwareMalware2026-10-08
• Google Dismantles XCPE Botnet of 1.3 Million Android DevicesBotnet2026-11-03