Realtek Jungle SDK Exploit Attempts Deliver Cling Botnet With STUN-Based C2

What happened?

Threat actors have been observed attempting to exploit a now-patched critical security flaw impacting the Realtek Jungle software development kit (SDK) to deploy a botnet malware called Cling. "Cling is notable not because it introduces a new propagation technique, but because it repurposes ordinary STUN behavior into a practical command-and-control channel," Nozomi Networks said in a report

Key details

• Threat actors exploit CVE-2021-35394 in Realtek Jungle SDK to deploy Cling botnet.
• Cling replaces wget binary to execute malware when wget is invoked.
• Cling sends STUN Binding Requests to 13 hard-coded servers every 5 seconds with zero transaction ID.
• Cling abuses STUN infrastructure to receive operator commands via transaction ID field.

Summarised by SecOraLens from The Hacker News. Always read the original source before acting. How SecOraLens verifies advisories.