ClingSTUN Backdoor Exploits Multiple IoT Vulnerabilities to Gain Persistent Remote Access

What happened?

ClingSTUN is a Linux backdoor that exploits vulnerable internet-connected devices to give attackers lasting remote access. Rather than simply infecting routers and cameras, it turns compromised equipment into remotely controlled proxy nodes that can relay traffic and run commands. The campaign targets known security flaws across multiple vendors, expanding its attack methods as it evolves. Unpatched firmware, unsupported hardware, and exposed services create openings for infections that can survive device restarts and conceal their activity from routine checks.

Key details

• ClingSTUN is a Linux backdoor that leverages vulnerable internet‑connected devices to grant attackers persistent remote access.
• Compromised routers and cameras are turned into proxy nodes that can forward traffic and execute commands remotely.
• ClingSTUN creates hidden executable copies and edits three boot scripts to ensure it runs at startup.
• It disables watchdog timers and kills selected processes to prevent competing software from running.
• The malware uses the STUN protocol to discover external address and port mappings for communication.
• A 20‑byte operator packet can trigger remote command execution or self‑propagation on infected devices.

Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.