ClingSTUN hides IoT backdoor communications using public STUN servers

The Linux malware compromises vulnerable internet-connected devices and turns them into proxy nodes, using legitimate STUN infrastructure to obscure its communications. Dark Reading reports that it exploits 24 known flaws. According to Cyber Security News, attacks begin against devices running vulnerable Realtek software, and control traffic masquerades as replies from Google's public STUN service.

• SecurityWeek reports that ClingSTUN establishes persistence and includes exploits for self-propagation.
• FortiGuard Labs identified the malware family, according to Security Affairs.

Covered by 4 publishers within 23 hours of the first report.

• Security Affairs: ClingSTUN Linux Backdoor Abuses Public STUN Infrastructure

Reporting4

CSN Cyber Security News Cling Malware Masquerades as Google STUN Traffic to Control Compromised IoT Devices · Tushar Subhra Dutta 3:43 AM

SW SecurityWeek Linux Backdoor Abuses STUN Protocol, Exploits Dozens of Flaws · Ionut Arghire 9:00 AM

DR Dark Reading ClingSTUN Turns Vulnerable IoT Devices Into Proxy Nodes · Jai Vijayan 5:25 PM

SAF Security Affairs ClingSTUN Linux Backdoor Abuses Public STUN Infrastructure · Pierluigi Paganini 2:31 AM

Related

TNW Google and JPMorgan join three organizations in fixing MCP server flaw October 5

BC Google pauses open-source product bug reports after surge in AI submissions October 5

DR Google uses PageBreak AI agent to uncover flaws in its web apps October 5

BC Nikkei says attackers breached employee email accounts October 5

Topics Google