ClingSTUN is a Linux malware campaign targeting vulnerable Internet-facing IoT and network edge devices by exploiting known vulnerabilities. It installs a back-connect proxy backdoor that enables persistent remote access and converts compromised devices into proxy nodes. The malware supports multiple Linux architectures and employs techniques such as boot persistence, process concealment, remote command execution, and self-propagation. It abuses public STUN infrastructure to facilitate NAT traversal. The campaign targets devices from multiple vendors including D-Link, EnGenius, Realtek, TP-Link, AVTECH, Ivanti, Tenda, and Lantronix, emphasizing risks from unpatched and exposed devices.