Insights, news, education and announcements from PolySwarm | ClingSTUN

ClingSTUN Turns Vulnerable Edge Devices Into Attacker Infrastructure

Oct 13, 2026, 1:55:06 PM / by The Hivemind posted in Threat Bulletin, Linux, Linux Malware, proxy malware, ClingSTUN, IoT malware, ClingSTUN malware

Related Families: Mirai

Executive Summary

An evolving Linux malware campaign was observed deploying ClingSTUN, a back-connect proxy backdoor that exploits known vulnerabilities in Internet-facing IoT and embedded/network devices to establish persistent access and convert compromised systems into remotely controlled proxy nodes. ClingSTUN supports multiple Linux architectures and combines boot persistence, process termination, watchdog manipulation, process concealment, remote command execution, and self-propagation with an unusual technique that abuses legitimate public STUN infrastructure for NAT traversal. The campaign has expanded the number of vulnerabilities and device vendors it targets over time, highlighting the continued risk posed by unpatched, unsupported, and unnecessarily exposed Internet-facing devices.

Read More