ClingSTUN Linux Backdoor Uses STUN for Proxying and Exploits Dozens of Flaws
Summary
FortiGuard Labs reports that the ClingSTUN Linux backdoor exploits dozens of flaws to spread, persists across reboots, and uses STUN servers to maintain proxy connections and receive remote commands.
Key points
- ClingSTUN targets two dozen vulnerabilities for initial access and includes hardcoded exploits for seven additional flaws to self-propagate.
- The backdoor uses downloaders to fetch payloads for AMD X86-64, ARM, Intel 80386, MIPS R3000, and PowerPC architectures.
- It persists by copying itself to hidden executable files and appending startup commands to three system initialization scripts.
- ClingSTUN uses UDP and standard STUN binding requests to establish endpoint connections, then periodically sends a group identifier and mapped-port list to the same STUN endpoints.
- The malware listens for specific packets that enable remote code execution and trigger self-propagation; observed variants also kill competing processes and terminate a watchdog timer.
- FortiGuard Labs says no separate coordination-server registration was identified in the STUN communication path and cautions that public STUN services are not necessarily attacker-controlled infrastructure.
Article Details
- Attack Vectors
- ClingSTUN exploits vulnerabilities in affected devices for initial access and includes hardcoded exploits for self-propagation.
- Downloaders retrieve malware payloads for multiple processor architectures.
- The backdoor uses public STUN servers for endpoint mapping and NAT connectivity, and listens for specific packets that can trigger remote code execution and self-propagation.
- Defensive Notes
- Do not automatically classify public STUN servers as attacker-controlled infrastructure. Assess STUN activity alongside suspicious process behavior, unexpected UDP connections, and recurring keepalive traffic.
MITRE ATT&CK
Malware
Vendors
AVTECHThe malware’s operators were seen indiscriminately exploiting Avtech, EnGenius, D-Link, Hytec, Ivanti, Lantronix, Linear, MeiG, Realtek, Sunhillo, Tenda, and TP-Link flaws, and appear to be expanding their portfolioChina MobileAdditionally, the backdoor includes a self-propagation mechanism containing hardcoded exploits for seven China Mobile, KGUARD, Linksys, LB-LINK, MVPower, Realtek, and TBK vulnerabilities.D-LinkThe malware’s operators were seen indiscriminately exploiting Avtech, EnGenius, D-Link, Hytec, Ivanti, Lantronix, Linear, MeiG, Realtek, Sunhillo, Tenda, and TP-Link flaws, and appear to be expanding their portfolioEnGeniusThe malware’s operators were seen indiscriminately exploiting Avtech, EnGenius, D-Link, Hytec, Ivanti, Lantronix, Linear, MeiG, Realtek, Sunhillo, Tenda, and TP-Link flaws, and appear to be expanding their portfolioHytecThe malware’s operators were seen indiscriminately exploiting Avtech, EnGenius, D-Link, Hytec, Ivanti, Lantronix, Linear, MeiG, Realtek, Sunhillo, Tenda, and TP-Link flaws, and appear to be expanding their portfolioIvantiThe malware’s operators were seen indiscriminately exploiting Avtech, EnGenius, D-Link, Hytec, Ivanti, Lantronix, Linear, MeiG, Realtek, Sunhillo, Tenda, and TP-Link flaws, and appear to be expanding their portfolioKGUARDAdditionally, the backdoor includes a self-propagation mechanism containing hardcoded exploits for seven China Mobile, KGUARD, Linksys, LB-LINK, MVPower, Realtek, and TBK vulnerabilities.LantronixThe malware’s operators were seen indiscriminately exploiting Avtech, EnGenius, D-Link, Hytec, Ivanti, Lantronix, Linear, MeiG, Realtek, Sunhillo, Tenda, and TP-Link flaws, and appear to be expanding their portfolioLB-LINKAdditionally, the backdoor includes a self-propagation mechanism containing hardcoded exploits for seven China Mobile, KGUARD, Linksys, LB-LINK, MVPower, Realtek, and TBK vulnerabilities.Linearoperators were seen indiscriminately exploiting Avtech, EnGenius, D-Link, Hytec, Ivanti, Lantronix, Linear, MeiG, Realtek, Sunhillo, Tenda, and TP-Link flaws, and appear to be expanding their portfolio with otherLinksysAdditionally, the backdoor includes a self-propagation mechanism containing hardcoded exploits for seven China Mobile, KGUARD, Linksys, LB-LINK, MVPower, Realtek, and TBK vulnerabilities.MeiGwere seen indiscriminately exploiting Avtech, EnGenius, D-Link, Hytec, Ivanti, Lantronix, Linear, MeiG, Realtek, Sunhillo, Tenda, and TP-Link flaws, and appear to be expanding their portfolio with otherMVPowerAdditionally, the backdoor includes a self-propagation mechanism containing hardcoded exploits for seven China Mobile, KGUARD, Linksys, LB-LINK, MVPower, Realtek, and TBK vulnerabilities.Realtekwere seen indiscriminately exploiting Avtech, EnGenius, D-Link, Hytec, Ivanti, Lantronix, Linear, MeiG, Realtek, Sunhillo, Tenda, and TP-Link flaws, and appear to be expanding their portfolio with other exploits asSunhilloindiscriminately exploiting Avtech, EnGenius, D-Link, Hytec, Ivanti, Lantronix, Linear, MeiG, Realtek, Sunhillo, Tenda, and TP-Link flaws, and appear to be expanding their portfolio with other exploits as well.TBKAdditionally, the backdoor includes a self-propagation mechanism containing hardcoded exploits for seven China Mobile, KGUARD, Linksys, LB-LINK, MVPower, Realtek, and TBK vulnerabilities.Tendaexploiting Avtech, EnGenius, D-Link, Hytec, Ivanti, Lantronix, Linear, MeiG, Realtek, Sunhillo, Tenda, and TP-Link flaws, and appear to be expanding their portfolio with other exploits as well.TP-LinkAvtech, EnGenius, D-Link, Hytec, Ivanti, Lantronix, Linear, MeiG, Realtek, Sunhillo, Tenda, and TP-Link flaws, and appear to be expanding their portfolio with other exploits as well.