ClingSTUN Backdoor Exploits Multiple IoT Vulnerabilities to Gain Persistent Remote Access

ClingSTUN is a Linux backdoor that exploits vulnerable internet-connected devices to give attackers lasting remote access.

Rather than simply infecting routers and cameras, it turns compromised equipment into remotely controlled proxy nodes that can relay traffic and run commands. The campaign targets known security flaws across multiple vendors, expanding its attack methods as it evolves.

Unpatched firmware, unsupported hardware, and exposed services create openings for infections that can survive device restarts and conceal their activity from routine checks. Fortinet researchers identified three stages of the campaign, each using a different download source.

Fortinet said in a report shared with Cyber Security News (CSN) that ClingSTUN combines vulnerability exploitation, startup persistence, and public networking services to maintain access to infected Linux devices.

The October 5 analysis describes a high-severity threat but does not provide an infection count or confirmed victim list.

Its findings show how ordinary connected equipment can become persistent attack infrastructure, with consequences extending beyond the device originally compromised.

ClingSTUN Backdoor Exploits Multiple IoT Vulnerabilities

Researchers first observed delivery through CVE-2022-36553, a command injection flaw in Hytec Inter HWL-2511-SS routers.

That initial stage lasted only two days before the attackers changed download infrastructure and broadened their exploitation strategy to reach additional vulnerable products.

The second stage targeted the EnGenius cloud service vulnerability CVE-2025-34035 and D-Link UPnP flaw CVE-2024-23625. Later activity added Realtek, Linear, TP-Link, AVTECH, and other devices, showing that the operators were not relying on one manufacturer or a single entry point.

Among those targets was CVE-2023-1389 in TP-Link Archer AX21 routers. Earlier reporting on TP-Link command injection attacks documented exploitation of the same weakness, illustrating how familiar vulnerabilities remain useful to attackers when exposed devices stay unpatched.

The campaign also exploited CVE-2024-7029 in AVTECH AVM1203 cameras, a weakness previously associated with Mirai attacks against cameras in another campaign. The overlap concerns reused vulnerabilities, not evidence that ClingSTUN belongs to the same malware family or shares those operators.

Downloaders retrieve versions for ARM, Intel 80386, MIPS R3000, PowerPC, and AMD x86-64 systems. The newest downloader also removes certain process-related mounts and terminates processes running from temporary storage, helping clear competing activity before the backdoor establishes itself.

ClingSTUN then creates hidden executable copies and modifies three startup files so it runs during boot. It also disables watchdog timers and kills selected processes, combining persistence with interference against programs that could compete with it on the infected device.

Public STUN Services Conceal Connectivity

ClingSTUN clears its command-line arguments to make ordinary process listings less informative. When running with administrator privileges, it overlays its process information with metadata copied from the system’s initial process.

Similar Linux malware process concealment techniques highlight why appearance alone cannot establish whether a process is legitimate.

The backdoor uses STUN, a protocol commonly involved in internet calls and browser communications, to discover external address and port mappings.

The analyzed second version contacted 24 public endpoints; the third reduced that number to 13 and required successful connections to every endpoint. A 20-byte operator packet can activate remote command execution or self-propagation.

One command directs an outbound TCP connection to a specified endpoint, where the malware receives instructions to execute. Researchers identified seven built-in vulnerability exploits supporting further spread to routers and recording equipment.

However, researchers could not verify how operators obtain the external mappings and deliver control traffic through network address translation. Public STUN servers should not automatically be treated as malicious infrastructure.

Defenders should instead correlate these connections with suspicious processes, unexpected UDP activity, and recurring keepalive traffic.

Fortinet recommends inventorying internet-facing devices, tracking firmware support, and promptly patching actively exploited vulnerabilities.

Unsupported equipment should be replaced or isolated, while unnecessary exposed services should be restricted. Monitoring startup changes alongside unusual network behavior helps identify devices that have become persistent backdoors.

The indicators below reproduce campaign hosts, hashes, and observed artifacts from the source. Public STUN endpoints provide investigative context and are not confirmed attacker-controlled infrastructure.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stops threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC