---
title: ClingSTUN Turns Vulnerable Edge Devices Into Attacker Infrastructure
description: An evolving Linux malware campaign was observed deploying ClingSTUN, a back-connect proxy backdoor that exploits known vulnerabilities in Internet-facing IoT and embedded/network devices to establish persistent access and convert compromised systems into remotely controlled proxy nodes.
---

[Insights, news, education and announcements from PolySwarm](https://blog.polyswarm.io)

# [ClingSTUN Turns Vulnerable Edge Devices Into Attacker Infrastructure](https://blog.polyswarm.io/clingstun-turns-vulnerable-edge-devices-into-attacker-infrastructure)

 Written by [The Hivemind](https://blog.polyswarm.io/author/the-hivemind) | Oct 13, 2026, 5:55:06 PM

**Related Families:** Mirai

## **Executive Summary**

## An evolving Linux malware campaign was observed deploying ClingSTUN, a back-connect proxy backdoor that exploits known vulnerabilities in Internet-facing IoT and embedded/network devices to establish persistent access and convert compromised systems into remotely controlled proxy nodes. ClingSTUN supports multiple Linux architectures and combines boot persistence, process termination, watchdog manipulation, process concealment, remote command execution, and self-propagation with an unusual technique that abuses legitimate public STUN infrastructure for NAT traversal. The campaign has expanded the number of vulnerabilities and device vendors it targets over time, highlighting the continued risk posed by unpatched, unsupported, and unnecessarily exposed Internet-facing devices.

**Key Takeaways**

- ClingSTUN targets Internet-facing IoT and embedded/network devices through known vulnerabilities, with observed exploitation affecting products from vendors including D-Link, EnGenius, Realtek, TP-Link, AVTECH, Ivanti, Tenda, Lantronix, and others.
- The malware turns compromised Linux devices into persistent proxy nodes while supporting ARM, Intel 80386, MIPS R3000, PowerPC, and AMD x86-64 architectures.
- ClingSTUN abuses legitimate public STUN infrastructure for NAT traversal, allowing it to discover external IP and port mappings and maintain connectivity while potentially blending with normal VoIP and WebRTC traffic.
- The malware can propagate to additional vulnerable devices using seven hard-coded exploits, increasing its ability to expand beyond the initially compromised system.

**What is ClingSTUN?**

ClingSTUN is a Linux back-connect proxy backdoor designed to maintain persistent access to compromised devices and transform them into remotely controlled proxy nodes. FortiGuard Labs [observed](https://www.fortinet.com/blog/threat-research/clingstun-linux-backdoor-abuses-public-stun-infrastructure) the malware being distributed by exploiting known vulnerabilities in Internet-facing devices, with the campaign expanding its selection of vulnerabilities and affected vendors as it evolved.

The malware's functionality extends beyond basic proxying. ClingSTUN manipulates watchdog functionality, kills competing processes, establishes boot persistence, attempts to conceal its execution, supports remote command execution, and contains built-in exploits capable of propagating the malware to additional vulnerable devices.

A particularly notable component of ClingSTUN is its use of Session Traversal Utilities for NAT (STUN). STUN is legitimately used by technologies such as VoIP and WebRTC to determine public-facing IP addresses and ports for systems operating behind NAT. ClingSTUN repurposes this functionality to discover its externally mapped network information and maintain NAT bindings, improving connectivity between compromised devices and remote operators. This technique creates an additional detection challenge because the public STUN services contacted by ClingSTUN are legitimate third-party infrastructure rather than inherently malicious C2 systems.

**Campaign Evolution and Exploitation**

FortiGuard Labs divided observed ClingSTUN activity into three periods, distinguished primarily by changing malware download infrastructure and an expanding exploitation strategy. The earliest observed activity delivered ClingSTUN through exploitation of [CVE-2022-36553](https://nvd.nist.gov/vuln/detail/cve-2022-36553), a command-injection vulnerability affecting Hytec Inter HWL-2511-SS routers. This initial phase used 124\[.\]163\[.\]212\[.\]119 as its download source and lasted approximately two days before the infrastructure changed.

During the second period, the threat actor broadened its approach rather than concentrating on a single vulnerability. Initial access included exploitation of [CVE-2025-34035](https://nvd.nist.gov/vuln/detail/cve-2025-34035), a command-injection vulnerability affecting the EnGenius EnShare IoT Gigabit Cloud Service, and [CVE-2024-23625](https://nvd.nist.gov/vuln/detail/cve-2024-23625), affecting D-Link UPnP functionality. Additional observed exploitation targeted Linear devices, Realtek SDK implementations, TP-Link Archer AX21 routers, AVTECH AVM1203 devices, D-Link products, and a buffer overflow affecting the goform name parameter across multiple vendors.

The third observed period further expanded the campaign's vulnerability coverage. Fortinet documented exploitation involving products from vendors including EnGenius, D-Link, Linear, Realtek, TP-Link, Sunhillo, Ivanti, Tenda, Hytec, AVTECH, MeiG, and Lantronix. At the time of Fortinet's reporting, researchers continued to find ClingSTUN traces associated with additional vulnerabilities, indicating that its exploitation portfolio remained under active development. The progression from exploitation of a single vulnerability to a broader multi-vendor vulnerability set suggests an effort to increase the pool of Internet-facing devices available for compromise rather than dependence on one particular product ecosystem.

**Technical Analysis**

Multi-Architecture Deployment

ClingSTUN's downloader retrieves malware variants compiled for several Linux architectures, including ARM, Intel 80386, MIPS R3000, PowerPC, and AMD x86-64. This architecture coverage enables ClingSTUN to execute across a diverse collection of Linux-based IoT, networking, and embedded hardware. Fortinet identified three evolutionary versions of the downloader. The third-generation downloader introduced additional aggressive behavior, including examining /proc/mounts, unmounting certain mount points, killing associated processes, and terminating processes whose executables reside within /tmp.

Process and Watchdog Manipulation

ClingSTUN opens /dev/watchdog and /dev/misc/watchdog with read and write permissions and uses the ioctl system call to terminate the watchdog timer. The malware also enumerates /proc to identify other running processes. It examines process command lines and executable locations, checks for executables running from /tmp and /var/tmp, and can terminate processes when their command-line information does not match the actual executable basename.

Persistence and Process Concealment

ClingSTUN establishes persistence by copying itself to /root/.cling and /usr/local/bin/.cling. It then modifies /etc/inittab, /etc/init.d/rcS, and /etc/rc.d/rc.boot to execute the malware during system boot. After establishing persistence, ClingSTUN clears its original command-line arguments, causing its command line to appear empty in utilities such as ps. When executing as root, it further conceals itself by copying selected process information from /proc/1/ to /tmp and bind-mounting that data over its own /proc/\<pid\> directory, effectively disguising its process information with metadata copied from PID 1.

STUN-Based NAT Traversal

ClingSTUN establishes a UDP socket on a random local port and issues standard 20-byte STUN binding requests to public STUN endpoints. Earlier malware versions contacted 24 endpoints and required at least half of those exchanges to succeed, while the third evolution reduced the list to 13 endpoints and required successful connectivity to all of them. These exchanges allow ClingSTUN to learn the external IP addresses and ports assigned through NAT. After the STUN exchanges complete, the malware periodically transmits its group identifier and mapped-port list to those endpoints.

Fortinet did not identify a separate coordination-server registration mechanism in this process and had not verified how the operator obtains the external mapping information and subsequently delivers control traffic through NAT. Fortinet notes that the mechanism through which the operator obtains the mapping and delivers control traffic therefore remains unverified.

Remote Command Execution

ClingSTUN listens for a 20-byte control packet capable of activating additional functionality. When an appropriate control datagram reaches a retained UDP socket, one command instructs the malware to establish a separate outbound TCP connection to an endpoint specified in the message. ClingSTUN then receives a command through that connection and executes it on the compromised system.

Self-Propagation

Fortinet identified seven hard-coded exploits within ClingSTUN that allow compromised systems to target additional vulnerable devices. These affect products or technologies associated with Realtek, MVPower, TBK, Linksys, LB-LINK, China Mobile, and KGUARD and include vulnerabilities dating from 2014 through 2026. This capability means an infected device can serve not only as a persistent proxy node but also as a platform for expanding the campaign to additional exposed systems.

**Analyst Commentary**

ClingSTUN demonstrates why Internet-facing IoT and embedded devices should not be treated as secondary security concerns. This campaign does not require a novel zero-day exploitation chain to create useful attacker infrastructure. Instead, its operators are leveraging known vulnerabilities across an expanding collection of products and vendors. A device that remains exposed after a vulnerability becomes public can provide attackers with persistent access, proxy infrastructure, and a foothold from which to identify additional vulnerable systems.

Its use of legitimate STUN infrastructure makes the campaign particularly relevant to defenders relying heavily on traditional infrastructure-based indicators. STUN communications cannot automatically be treated as evidence of compromise because the protocol is routinely used by legitimate VoIP and WebRTC applications, and Fortinet specifically cautions that the public STUN services contacted by ClingSTUN should not automatically be classified as attacker-controlled infrastructure. Blocking known-bad infrastructure is not enough when malware can abuse legitimate Internet services as part of its communications workflow. Defenders need visibility into the malware itself, associated artifacts, suspicious behavior, and emerging indicators surrounding the campaign rather than relying exclusively on static network blocklists.

This is where PolySwarm's multi-engine malware detection and threat intelligence approach provides additional defensive value. Instead of relying on a single vendor's classification or waiting for one security product to identify a developing threat, PolySwarm gives defenders access to detection verdicts and threat intelligence from a diverse ecosystem of security engines. For threats such as ClingSTUN, where legitimate infrastructure can complicate network-based detection, being able to rapidly evaluate suspicious files and artifacts across multiple independent detection technologies can provide additional context for triage and investigation.

Organizations should use the ClingSTUN campaign as an opportunity to evaluate whether their detection strategy extends beyond perimeter blocking. PolySwarm can help security teams determine whether suspicious artifacts are being recognized across the broader detection ecosystem, identify emerging malicious files, and enrich investigations with intelligence that complements network and endpoint telemetry. ClingSTUN also illustrates why end-of-life network and IoT equipment represents a persistent security liability. An Internet-facing device that can no longer receive vendor security updates may remain exploitable indefinitely. Patching and reducing exposure remain the first line of defense, but organizations should pair those fundamentals with layered malware detection and threat intelligence capable of identifying malicious activity when prevention fails.

**IOCs**

PolySwarm has multiple samples associated with this activity.

 

4fbd61cb9181ebbc4fe9a6e59d3c346dc00001da48d66bd890556fc6fad22b07

121f2050e3c891b29565fd73451fff7ae60199c86eb8d79ec1eb1d9844578487

48f9b72ce72ab7087794650d6eef10135345088384fbde1482f1c74a02b80302

e6e113783356446aef66e5296db45b244f318292af7cebc2a9bd76f095a95c4c

c1d8e2829ea63b9dc1cf2c3421a5093406adad4d6622e238376e78e908e0e6e8

76692a23abe718b93e63edefd743971ec627c0cdf3778f856bd5ec88003deaa2

ec199c78c11040fd3127887222fd75a85e5797bf96aa691a117fdd83dd663d81

dfba6008a2c828a9cb62342aec53006ae05a60cb8d4c41c3fa216fd727e8c6a3

e4d12208789f36efc5a1ff765088fed95d6bb5972d1a804a4536fd42366797d4

284e5ec8748f99fd1b8c331b699a5fe5fd4448bbaae0347a940f427f931c4d14

6581bf37184bb2db899b9893064d39dd314ea691adf3281cc0aa7e0a31e5138a

48962b3893f2c8261e32e6b95ea7d463d145a529a8b2a6c987dd979454405c73

10d83c1748895361e07320f68d44d427b43cadd2cbffe0ab5e607ab03aec83da

dc892f5013edb0aa1e61e808511387373d8d120348b5be0929621d21e6e9946a

5c4e263546fb21f8fe8732789a5b6583eaa8ae11ebeef099462a7c9bf50e022d

f49f45303cbfccee14ff193ac9608f860e6d616f08c0ecbef1ec44f7c863d7ec

9391c6ad17aced1142607c0c623b18d86a7697cc483d204ffac94093e26b8068

2ed54e0f988a62039abed88f6394eb1e3d5ed931f0183556055417fb08844ecf

B90640b392827b4f2d280f6cf67860862953331917d42df23e1653a92f2f98ad

 

***Don’t have a PolySwarm account? Go***[**here**](https://polyswarm.network/)***to sign up for a free Community plan or subscribe.***

***Contact us at***[**hivemind@polyswarm.io**](mailto:hivemind@polyswarm.io)***| Check out our***[**blog**](https://blog.polyswarm.io/)*|* [**Subscribe**](https://polyswarm.io/ransomwarereport/)***to our reports.***

 

[View full post](https://blog.polyswarm.io/clingstun-turns-vulnerable-edge-devices-into-attacker-infrastructure)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "The Hivemind"
  },
  "dateModified" : "2026-10-13T17:55:06.979Z",
  "datePublished" : "2026-10-13T17:55:06Z",
  "headline" : "ClingSTUN Turns Vulnerable Edge Devices Into Attacker Infrastructure",
  "image" : {
    "@type" : "ImageObject",
    "height" : 900,
    "url" : "https://5737925.fs1.hubspotusercontent-na1.net/hubfs/5737925/Threat%20Bulletins/Threat%20Bulletin%20Images/ClingSTUN2026.jpg",
    "width" : 1600
  },
  "mainEntityOfPage" : "https://blog.polyswarm.io/clingstun-turns-vulnerable-edge-devices-into-attacker-infrastructure",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60.0,
      "url" : "https://cdn2.hubspot.net/hubfs/5737925/Social%20Icons_PS-1.png",
      "width" : 59.820896
    },
    "name" : "The PolySwarm Blog"
  }
}
```