“ClingSTUN” Linux backdoor turns IoT devices into proxy nodes and hides its C2 inside public STUN traffic

What happened

• On 5 October 2026, FortiGuard Labs published research on a Linux backdoor it named ClingSTUN, a back-connect proxy backdoor that turns compromised devices into remotely controlled proxy nodes. Fortinet rates the severity High and lists the affected platform as IoT devices (Fortinet).
• The malware spreads by exploiting known, unpatched flaws in internet-facing IoT devices, routers, DVRs and VPN appliances, and carries hard-coded exploits so compromised devices attack others (Infosecurity Magazine).
• FortiGuard observed three deployment periods, each using a different download server (Fortinet):
• Period 1 downloaded from 124.163.212.119, reached by exploiting CVE-2022-36553 on Hytec Inter HWL-2511-SS routers. It lasted only two days (Fortinet).
• Period 2 downloaded from 222.223.152.97 and broadened to EnGenius (CVE-2025-34035), D-Link UPnP (CVE-2024-23625), then Linear, Realtek, TP-Link, AVTECH and D-Link devices (Fortinet).
• Period 3 downloaded from 118.145.196.225 and added more entry points (Fortinet).
• The article gives no calendar dates for the three periods beyond the 5 October publication date (Fortinet). Infosecurity Magazine’s coverage was written by Alessandro Mascellino (Infosecurity Magazine).

How it works

Initial access. ClingSTUN gains a foothold by exploiting a long list of known command-injection and code-injection flaws in internet-facing devices. FortiGuard lists these entry-point CVEs (Fortinet):

• CVE-2025-34035 (EnGenius IoT cloud service)
• CVE-2024-23625, CVE-2024-23624, CVE-2019-17621 (D-Link UPnP)
• CVE-2019-7256 (Linear eMerge)
• CVE-2021-35394 (Realtek SDK UDPServer)
• CVE-2023-1389 (TP-Link Archer AX21)
• CVE-2021-36380 (Sunhillo SureLine)
• CVE-2024-21887, CVE-2023-46805 (Ivanti Connect Secure / Policy Secure)
• CVE-2024-46048, CVE-2024-35340, CVE-2024-32314, CVE-2024-32292, CVE-2024-32281, CVE-2022-35555, CVE-2022-26289 (Tenda exeCommand)
• CVE-2022-36553 (Hytec Inter HWL-2511-SS)
• CVE-2022-37055 (D-Link Go-RT-AC750)
• CVE-2024-7029 (AVTECH AVM1203)
• CVE-2024-10915, CVE-2024-10914 (D-Link account_mgr.cgi)
• CVE-2026-36356 (MeiG Smart FORGE_SLT711)
• CVE-2025-67038 (Lantronix EDS5000)

A downloader then fetches architecture-specific builds, ARM, Intel 80386, MIPS R3000, PowerPC and AMD x86-64, into /tmp. The third-period downloader adds logic to unmount and kill processes running from /tmp (Fortinet).

STUN abuse for C2. ClingSTUN binds a UDP socket to a random local port and sends standard 20-byte STUN binding requests to public STUN endpoints to learn its externally mapped IP address and ports and to keep NAT bindings open. The first two evolutions contact 24 public STUN endpoints and require at least half to succeed; the third contacts 13 and requires every one to succeed. It periodically sends its group identifier and mapped-port list to those same endpoints, then listens for a 20-byte operator packet, command 1 triggers an outbound TCP connection to an endpoint named in the message, from which it receives and executes a command (Fortinet). Because the STUN servers are legitimate, the traffic resembles normal VoIP and WebRTC. FortiGuard states that how the operator obtains the external mapping and delivers control traffic through NAT is unverified, and warns against treating the STUN services as attacker-controlled (Fortinet; Infosecurity Magazine).

Persistence and evasion (Fortinet):

• Copies itself to /root/.cling and /usr/local/bin/.cling, then appends those copies to /etc/inittab, /etc/init.d/rcS and /etc/rc.d/rc.boot for boot persistence.
• Opens /dev/watchdog and /dev/misc/watchdog and stops the timer via ioctl.
• Enumerates /proc and kills processes running from /tmp and /var/tmp, or whose cmdline does not match the executable basename, skipping its own process group.
• Clears its command-line arguments and, if running as root, copies PID 1 metadata to /tmp and bind-mounts /tmp over its own /proc/<pid> directory to disguise the process.
• In the third evolution, unmounts mount points whose filesystem type is not proc and kills the associated process.

Self-propagation. The malware carries hard-coded exploits for seven more vulnerabilities so each compromised device can attack others: CVE-2014-8361 (Realtek miniigd SOAP), CVE-2016-20016 (MVPower CCTV DVR), CVE-2024-3721 (TBK DVR), CVE-2025-34037 (Linksys ttcp_ip), CVE-2023-26801 (LB-LINK mac), CVE-2023-41011 (China Mobile HG6543C4) and CVE-2026-87827 (KGUARD DVR) (Fortinet).

Detection / what to do

1. Inventory internet-facing devices and patch the actively exploited flaws listed above; prioritise the CVEs in the entry-point list. Replace or isolate devices that no longer receive security updates (Infosecurity Magazine).
2. Review STUN activity alongside suspicious processes, unexpected UDP connections and recurring keepalive traffic, not STUN alone, since the servers are legitimate (Infosecurity Magazine).
3. Check hosts for the backdoor’s artifacts (Fortinet):

ls -la /root/.cling /usr/local/bin/.cling 2>/dev/null
grep -nE '\.cling' /etc/inittab /etc/init.d/rcS /etc/rc.d/rc.boot 2>/dev/null
ls -la /tmp /var/tmp 2>/dev/null   # architecture-specific payloads drop here

4. Fortinet detections: AV signatures BASH/Mirai.AEH!tr.dldr, BASH/Dloader.P!tr and Linux/Agent.BHT!tr; Web Filtering blocks the C2 server; IPS signatures cover the CVEs listed above (Fortinet).

Indicators of compromise

All IOCs below are from FortiGuard Labs, reproduced with the defanged notation as published (Fortinet).

Download / host IPs

124[.]163[.]212[.]119
222[.]223[.]152[.]97
118[.]145[.]196[.]225

File paths

/tmp  /var/tmp  /root/.cling  /usr/local/bin/.cling
/etc/inittab  /etc/init.d/rcS  /etc/rc.d/rc.boot
/dev/watchdog  /dev/misc/watchdog

File hashes (SHA256)

dc892f5013edb0aa1e61e808511387373d8d120348b5be0929621d21e6e9946a
a297eddfa7abea8d411afc0f150f8f6f30e470a77204de87e3b0815fa9bb8a84
4fbd61cb9181ebbc4fe9a6e59d3c346dc00001da48d66bd890556fc6fad22b07
121f2050e3c891b29565fd73451fff7ae60199c86eb8d79ec1eb1d9844578487
48f9b72ce72ab7087794650d6eef10135345088384fbde1482f1c74a02b80302
e6e113783356446aef66e5296db45b244f318292af7cebc2a9bd76f095a95c4c
c1d8e2829ea63b9dc1cf2c3421a5093406adad4d6622e238376e78e908e0e6e8
48962b3893f2c8261e32e6b95ea7d463d145a529a8b2a6c987dd979454405c73
76692a23abe718b93e63edefd743971ec627c0cdf3778f856bd5ec88003deaa2
ec199c78c11040fd3127887222fd75a85e5797bf96aa691a117fdd83dd663d81
c0d8ffebfba969b1c1ca76bd9623bb623e9f95155c8ceca77d8fcc521435a497
f49f45303cbfccee14ff193ac9608f860e6d616f08c0ecbef1ec44f7c863d7ec
9391c6ad17aced1142607c0c623b18d86a7697cc483d204ffac94093e26b8068
e4d12208789f36efc5a1ff765088fed95d6bb5972d1a804a4536fd42366797d4
284e5ec8748f99fd1b8c331b699a5fe5fd4448bbaae0347a940f427f931c4d14
6581bf37184bb2db899b9893064d39dd314ea691adf3281cc0aa7e0a31e5138a
10d83c1748895361e07320f68d44d427b43cadd2cbffe0ab5e607ab03aec83da
2ed54e0f988a62039abed88f6394eb1e3d5ed931f0183556055417fb08844ecf
b90640b392827b4f2d280f6cf67860862953331917d42df23e1653a92f2f98ad
dfba6008a2c828a9cb62342aec53006ae05a60cb8d4c41c3fa216fd727e8c6a3
5c4e263546fb21f8fe8732789a5b6583eaa8ae11ebeef099462a7c9bf50e022d

STUN endpoints contacted (legitimate services, do NOT block as attacker infrastructure; use only to recognise the traffic pattern)

5[.]39[.]72[.]109        77[.]72[.]169[.]213     154[.]73[.]34[.]8
20[.]14[.]234[.]56       81[.]187[.]30[.]115     185[.]125[.]180[.]70
64[.]131[.]63[.]217      82[.]113[.]193[.]63     207[.]38[.]82[.]134
66[.]51[.]128[.]1        83[.]211[.]9[.]232      212[.]53[.]40[.]43
74[.]125[.]250[.]129     85[.]17[.]88[.]164      212[.]227[.]67[.]33
77[.]72[.]169[.]210      85[.]93[.]219[.]114     212[.]227[.]67[.]34
77[.]72[.]169[.]211      139[.]162[.]62[.]29     216[.]93[.]246[.]18
77[.]72[.]169[.]212      145[.]249[.]115[.]184   217[.]0[.]0[.]249

Sources

• Fortinet (FortiGuard Labs): ClingSTUN Linux Backdoor Abuses Public STUN Infrastructure (5 October 2026)
• Infosecurity Magazine: ClingSTUN Backdoor Targets Unpatched IoT