ClingSTUN is a Linux malware strain that breaks into internet-facing devices through known, unpatched vulnerabilities and turns them into remotely controlled proxy nodes. FortiGuard Labs published its analysis on October 5, 2026 (author: Vincent Li), and SecurityWeek reported on it the same day, describing the malware as a back-connect proxy backdoor. The distinctive part is its use of public STUN servers, the same infrastructure behind VoIP and WebRTC, to learn its external IP address and port mappings and to keep NAT connectivity alive. STUN is not how the devices get infected: every infection starts with an ordinary exploit, which is also where defenders have the most leverage.
What ClingSTUN does
According to FortiGuard, ClingSTUN targets IoT and other internet-facing Linux devices. Once it is running, the infected system can be controlled remotely and used as a proxy node. Across the samples FortiGuard analyzed, the malware:
As an Amazon Associate I earn from qualifying purchases.
- runs a watchdog that terminates and restarts its own processes as needed;
- kills competing processes on the device;
- installs persistence so it survives reboots;
- conceals itself on the host;
- executes remote commands on operator instruction;
- propagates itself to other devices using a hardcoded set of exploits.
The downloaders that deliver it fetch builds for five processor architectures: ARM, Intel 80386, MIPS R3000, PowerPC and AMD x86-64. That spread matches the mix of routers, cameras, gateways and embedded boxes it goes after. FortiGuard observed three evolution periods in the campaign, each using different download sources.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallHow devices get infected: two separate exploit sets
FortiGuard reports two distinct groups of vulnerabilities. They have different roles and should not be treated as one list.
#1 Best Overall
| Initial-access exploits | Self-propagation exploits | |
|---|---|---|
| Role | Used by the campaign to deliver ClingSTUN to a device in the first place | Hardcoded in the malware, used by an infected device to spread to others |
| Size | Roughly two dozen vulnerabilities, per FortiGuard’s characterization as relayed by SecurityWeek; the list is current as of October 5, 2026 and FortiGuard says it keeps collecting vulnerabilities and updating signatures | Seven vulnerabilities |
| Vendor families | Avtech, EnGenius, D-Link, Hytec, Ivanti, Lantronix, Linear, MeiG, Realtek, Sunhillo, Tenda, TP-Link (as listed by SecurityWeek) | Realtek, MVPower, TBK, Linksys, LB-LINK, China Mobile, KGUARD |
Initial access
The campaign first delivered ClingSTUN by exploiting CVE-2022-36553, a command-injection flaw in Hytec Inter HWL-2511-SS routers. Later periods added other flaws, including command injection in the EnGenius IoT cloud service (CVE-2025-34035) and UPnP code injection in D-Link devices (CVE-2024-23625). FortiGuard’s report carries the full CVE list; use it directly rather than relying on the vendor names above.
Self-propagation
The seven hardcoded exploits, as FortiGuard lists them:
- CVE-2014-8361 (Realtek)
- CVE-2016-20016 (MVPower)
- CVE-2024-3721 (TBK)
- CVE-2025-34037 (Linksys)
- CVE-2023-26801 (LB-LINK)
- CVE-2023-41011 (China Mobile)
- CVE-2026-87827 (KGUARD)
Several of these are years old. A device that was never patched, or that no longer receives updates, is exposed to a worm-like spread path that costs the operator nothing extra.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Rank #2
A vendor appearing in either list does not mean every product from that vendor is vulnerable. Each CVE applies to specific models and firmware versions.
Why the traffic uses STUN
STUN (Session Traversal Utilities for NAT) lets a host behind NAT ask a public server what external address and port it appears as. VoIP and WebRTC rely on that. ClingSTUN borrows the same mechanism, as FortiGuard describes it:
- The malware opens a UDP socket on a random local port.
- It sends standard 20-byte STUN binding requests to a list of public STUN endpoints.
- After those exchanges, it periodically sends a group identifier and a list of mapped ports to the same STUN endpoints. This recurring traffic serves as a keepalive that holds the NAT mapping open.
- It listens for a 20-byte operator packet that can trigger remote command execution and self-propagation.
The endpoint lists differ between evolutions. An earlier one contacted 24 public endpoints and required at least half to succeed; a later one cut the list to 13 and required every connection to succeed. These are configurations FortiGuard saw in its samples, not general STUN behavior and not an estimate of how many hosts are infected.
What is not established
FortiGuard found no separate coordination-server registration in this path. How the operator obtains the external mapping and delivers control traffic through NAT is, by FortiGuard’s account, unverified. The public STUN servers appear to be used as shared, third-party infrastructure rather than as attacker-run servers, and FortiGuard says so directly:
“A notable feature is its abuse of legitimate public STUN servers to discover external IP addresses and port mappings, thereby helping maintain NAT connectivity. These third-party services should not be automatically classified as attacker-controlled infrastructure. Instead, defenders should assess STUN activity alongside suspicious process behavior, unexpected UDP connections, and recurring keepalive traffic.” — FortiGuard Labs, October 5, 2026
The practical consequence: blocking public STUN servers on the strength of this report alone is not recommended. They serve legitimate VoIP and WebRTC traffic, and a block list built from them would be both disruptive and incomplete.
Persistence and concealment on the device
FortiGuard documents these host-level behaviors, which give you something concrete to look for:
- Copies: the malware copies itself to
/root/.clingand/usr/local/bin/.clingand sets executable permissions. - Startup entries: it appends commands to
/etc/inittab,/etc/init.d/rcSand/etc/rc.d/rc.boot. - Argument scrubbing: it clears its original command-line arguments.
- Process hiding: when running as root, it can disguise process information with a bind mount over its own
/procentry.
What defenders should check
1. Inventory exposed devices by exact model and firmware
List every internet-facing router, camera, gateway, cloud-managed IoT device and embedded Linux system. Match exact models, firmware versions and exposed services against the CVEs in FortiGuard’s report. Vendor name alone is not evidence of vulnerability.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
2. Patch, and deal with unsupported hardware
Apply available security updates promptly. Track each device’s firmware support status, and replace or isolate devices that can no longer receive security updates. Given how old some of the self-propagation CVEs are, end-of-life gear is the likeliest weak point.
3. Cut unnecessary exposure
FortiGuard stresses limiting exposure: disable or restrict services that do not need to be reachable from the internet, such as remote administration, UPnP and cloud-management interfaces.
4. Hunt for the known host indicators
On devices where you have shell access, check the paths from the report. These are examples of how to do it, not commands from FortiGuard, and BusyBox-based firmware may lack some options:
ls -la /root/.cling /usr/local/bin/.clinggrep -n cling /etc/inittab /etc/init.d/rcS /etc/rc.d/rc.bootgrep ' /proc/[0-9]' /proc/self/mountinfoto spot a bind mount placed over a process’s/procdirectory, which is not normal.
These indicators are specific to the variants FortiGuard analyzed. A clean result does not clear a device, and the paths could change in later builds.
5. Correlate network and host behavior
Look for UDP traffic from a device that has no VoIP or WebRTC function, particularly:
- STUN binding requests sent in a burst to many public endpoints from a random local port (24 and 13 endpoints in the two configurations FortiGuard saw);
- recurring, regular keepalive-style packets to the same endpoints afterwards;
- any of the above alongside an unexplained process, a missing command line, or modified startup files.
STUN traffic on its own proves nothing. The combination does. A router or camera that talks STUN with no business reason, and also shows a hidden process or edited boot scripts, deserves immediate isolation and a firmware reflash from a trusted image.
What the evidence does not cover
The FortiGuard and SecurityWeek reports give no victim count, no named operator and no prevalence estimate, so none should be inferred from the number of CVEs or vendors. The counts above are technical figures from FortiGuard’s samples, not independent measurements. The campaign and vulnerability list may change after the October 5, 2026 publication date.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
