ClingSTUN Linux Backdoor Abuses Public STUN Services to Control Compromised IoT Devices

Oct 5, 2026 · Original article ↗

Summary

Fortinet details ClingSTUN, a persistent Linux backdoor that exploits unpatched IoT-device vulnerabilities, uses public STUN services for NAT traversal, and turns compromised systems into remotely controlled proxy nodes.

Key points

The campaign exploits known vulnerabilities in internet-facing routers, cameras, and other IoT devices to install ClingSTUN.
The malware persists through boot scripts, disables watchdog timers, kills competing processes, and disguises its process information.
ClingSTUN contacts public STUN endpoints to discover external IP and port mappings and maintain NAT connectivity.
A 20-byte control packet can trigger remote command execution or self-propagation; how operators deliver control traffic through NAT remains unverified.
The malware includes exploits for seven vulnerabilities to spread to additional devices.
Fortinet recommends patching or replacing unsupported devices, restricting unnecessary internet exposure, and monitoring suspicious processes and UDP traffic; it reports protections through updated FortiGuard signatures and services.

Article Details

Attack Vectors: Exploitation of known vulnerabilities in Internet-facing IoT devices and routers, including command injection, code injection, authentication bypass, and buffer overflow flaws.
Delivery and execution of architecture-specific ClingSTUN binaries by downloader scripts.
Self-propagation using hard-coded exploits for seven vulnerabilities.
Use of public STUN endpoints for NAT traversal and connectivity between compromised devices and remote operators.
Remote command execution through control datagrams, followed by an outbound TCP connection to an endpoint specified in the message.
Defensive Notes: Maintain an inventory of Internet-facing devices and track their firmware and support status.
Promptly apply security updates, prioritizing vulnerabilities known to be actively exploited; replace or isolate devices that no longer receive updates.
Disable or restrict unnecessary Internet-facing services.
Monitor for suspicious processes, unexpected UDP connections, and recurring keepalive traffic; assess STUN activity in context rather than treating public STUN services as attacker-controlled infrastructure.

Indicators of compromise

Type	Indicator	Context
IPV4	`118[.]145[.]196[.]225`	Reported most recent ClingSTUN download source.
IPV4	`124[.]163[.]212[.]119`	Reported ClingSTUN delivery and download source used after exploitation of CVE-2022-36553.
IPV4	`222[.]223[.]152[.]97`	Reported ClingSTUN download source in the campaign's second period.
SHA256	`10d83c1748895361e07320f68d44d427b43cadd2cbffe0ab5e607ab03aec83da`	File hash listed as a ClingSTUN campaign indicator.
SHA256	`121f2050e3c891b29565fd73451fff7ae60199c86eb8d79ec1eb1d9844578487`	File hash listed as a ClingSTUN campaign indicator.
SHA256	`284e5ec8748f99fd1b8c331b699a5fe5fd4448bbaae0347a940f427f931c4d14`	File hash listed as a ClingSTUN campaign indicator.
SHA256	`2ed54e0f988a62039abed88f6394eb1e3d5ed931f0183556055417fb08844ecf`	File hash listed as a ClingSTUN campaign indicator.
SHA256	`48962b3893f2c8261e32e6b95ea7d463d145a529a8b2a6c987dd979454405c73`	File hash listed as a ClingSTUN campaign indicator.
SHA256	`48f9b72ce72ab7087794650d6eef10135345088384fbde1482f1c74a02b80302`	File hash listed as a ClingSTUN campaign indicator.
SHA256	`4fbd61cb9181ebbc4fe9a6e59d3c346dc00001da48d66bd890556fc6fad22b07`	File hash listed as a ClingSTUN campaign indicator.
SHA256	`5c4e263546fb21f8fe8732789a5b6583eaa8ae11ebeef099462a7c9bf50e022d`	File hash listed as a ClingSTUN campaign indicator.
SHA256	`6581bf37184bb2db899b9893064d39dd314ea691adf3281cc0aa7e0a31e5138a`	File hash listed as a ClingSTUN campaign indicator.
SHA256	`76692a23abe718b93e63edefd743971ec627c0cdf3778f856bd5ec88003deaa2`	File hash listed as a ClingSTUN campaign indicator.
SHA256	`9391c6ad17aced1142607c0c623b18d86a7697cc483d204ffac94093e26b8068`	File hash listed as a ClingSTUN campaign indicator.
SHA256	`a297eddfa7abea8d411afc0f150f8f6f30e470a77204de87e3b0815fa9bb8a84`	File hash listed as a ClingSTUN campaign indicator.
SHA256	`b90640b392827b4f2d280f6cf67860862953331917d42df23e1653a92f2f98ad`	File hash listed as a ClingSTUN campaign indicator.
SHA256	`c0d8ffebfba969b1c1ca76bd9623bb623e9f95155c8ceca77d8fcc521435a497`	File hash listed as a ClingSTUN campaign indicator.
SHA256	`c1d8e2829ea63b9dc1cf2c3421a5093406adad4d6622e238376e78e908e0e6e8`	File hash listed as a ClingSTUN campaign indicator.
SHA256	`dc892f5013edb0aa1e61e808511387373d8d120348b5be0929621d21e6e9946a`	File hash listed as a ClingSTUN campaign indicator.
SHA256	`dfba6008a2c828a9cb62342aec53006ae05a60cb8d4c41c3fa216fd727e8c6a3`	File hash listed as a ClingSTUN campaign indicator.
SHA256	`e4d12208789f36efc5a1ff765088fed95d6bb5972d1a804a4536fd42366797d4`	File hash listed as a ClingSTUN campaign indicator.
SHA256	`e6e113783356446aef66e5296db45b244f318292af7cebc2a9bd76f095a95c4c`	File hash listed as a ClingSTUN campaign indicator.
SHA256	`ec199c78c11040fd3127887222fd75a85e5797bf96aa691a117fdd83dd663d81`	File hash listed as a ClingSTUN campaign indicator.
SHA256	`f49f45303cbfccee14ff193ac9608f860e6d616f08c0ecbef1ec44f7c863d7ec`	File hash listed as a ClingSTUN campaign indicator.