Linux Backdoor Abuses STUN Protocol, Exploits Dozens of Flaws

ClingSTUN is a Linux backdoor that functions as a back-connect proxy by abusing the Session Traversal Utilities for NAT (STUN) protocol to maintain network connectivity through NAT devices. It establishes persistence by copying itself to hidden executable files and modifying system initialization scripts to run on boot. The malware exploits dozens of known vulnerabilities across multiple device vendors for initial infection and self-propagation, including hardcoded exploits for seven additional vulnerabilities in devices from China Mobile, KGUARD, Linksys, and others. It supports multiple CPU architectures (AMD X86-64, ARM, Intel 80386, MIPS R3000, PowerPC) and includes functionality to kill competing malware processes and terminate watchdog timers. ClingSTUN communicates with public STUN servers to discover external IP addresses and port mappings, avoiding direct use of attacker-controlled infrastructure. It listens for specific network packets to enable remote code execution and trigger propagation mechanisms.

The malware compromises Linux systems by establishing a persistent backdoor that turns infected hosts into proxies, enabling attackers to route traffic through them. It exploits numerous vulnerabilities in network devices and software to gain initial access and propagate, potentially expanding its reach. The use of legitimate STUN servers for NAT traversal complicates detection and attribution. The backdoor's ability to execute remote commands and kill competing malware increases its control over infected systems and persistence. This can lead to unauthorized access, lateral movement, and further compromise within affected networks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Defenders should monitor for unusual STUN protocol activity combined with suspicious processes, unexpected UDP connections, and recurring keepalive traffic. Since ClingSTUN abuses legitimate public STUN servers, detection should not rely solely on identifying STUN traffic but on correlating it with other malicious behaviors. Network segmentation and restricting outbound UDP traffic where feasible may help reduce exposure. Investigate and remediate known vulnerabilities in affected devices from the listed vendors to reduce initial infection vectors.