ClingSTUN Turns Your Forgotten Router Into Somebody Else’s Infrastructure
there is a Linux backdoor making the rounds that does not bother with clever zero days. it just drives down the list of ancient, unpatched edge device bugs, parks on whatever answers, and turns your end-of-life router into a proxy node. its party trick is abusing legitimate public STUN servers, the same NAT-traversal plumbing your video calls use, so the C2 traffic hides in infrastructure nobody blocks. it is called ClingSTUN, and it is a very polite reminder that the internet is mostly held together by hardware the vendor stopped loving years ago.
what ClingSTUN actually is
strip the branding and ClingSTUN is a back-connect proxy backdoor for Linux. it compromises an internet-facing device, achieves persistence across reboots, and then offers itself up as a remotely controlled proxy. your router becomes a hop in someone else’s chain, laundering their traffic through your IP address. it supports multiple Linux architectures, which is the tell of malware built for the embedded world where everything is some flavor of MIPS, ARM, or x86 that has not seen a firmware update since the last administration.
the feature list reads like a greatest-hits of embedded malware: boot persistence, process termination of rivals and security tooling, watchdog manipulation so the device does not reset it away, process concealment, remote command execution, and self-propagation to find the next victim. none of it is novel. all of it works, because the targets are devices that should have been recycled.
the STUN trick, briefly
STUN (Session Traversal Utilities for NAT) is the legitimate protocol your apps use to figure out their public-facing address so peer to peer connections can punch through NAT. it is everywhere, it is boring, and almost nobody inspects it. ClingSTUN abuses public STUN servers to handle NAT traversal for its proxy network, which means its coordination traffic rides on infrastructure that security teams treat as benign background noise. that is the whole point. hide the needle in the haystack everyone has agreed to ignore.
it does not need new bugs, and that is the scary part
ClingSTUN is not burning zero days. the IOC set tied to the campaign references dozens of known, old vulnerabilities across edge gear. a representative slice of the CVEs it leans on: CVE-2014-8361, CVE-2016-20016, CVE-2017-7921, CVE-2019-17621, CVE-2019-7256, CVE-2021-21974, CVE-2021-33044, CVE-2021-3493, CVE-2021-35394, CVE-2021-36380, CVE-2021-4034, CVE-2022-21894, CVE-2022-26134, CVE-2022-26289, and many more. some of these are a decade old. the oldest are from 2014. the common thread is that every one of them lives on a device that is internet-facing, unpatched, and frequently past end of life.
this is the uncomfortable economics of edge security. attackers do not need to be sophisticated when the installed base is this soft. a scanner, a list of old CVEs, and a proxy payload is a profitable business when millions of routers and cameras are sitting on public IPs with firmware from a vendor that no longer exists.
how to hunt it (read-only)
none of this changes your device. it tells you whether your edge gear is already somebody’s proxy. the loud behavioral tell is a small embedded device making STUN connections it has no business making, often from a process disguised as a kernel worker.
then match against the campaign IOCs. a representative set of proxy and C2 IPs reported for ClingSTUN:
118.145.196.225124.163.212.119139.162.62.29145.249.115.184154.73.34.8185.125.180.7020.14.234.56207.38.82.134
and a sample of the binary SHA256 hashes:
10d83c1748895361e07320f68d44d427b43cadd2cbffe0ab5e607ab03aec83da121f2050e3c891b29565fd73451fff7ae60199c86eb8d79ec1eb1d9844578487284e5ec8748f99fd1b8c331b699a5fe5fd4448bbaae0347a940f427f931c4d142ed54e0f988a62039abed88f6394eb1e3d5ed931f0183556055417fb08844ecf
finally, check the persistence spots. embedded malware loves rc.local, init scripts, cron, and watchdog config, because those survive reboots and there is nowhere else to hide on a device with no real endpoint agent.
what to actually do about it
- inventory what you have on public IPs. you cannot defend edge devices you forgot you deployed.
- patch firmware where a patch exists. where the device is end of life, replace it. there is no third option for a box with no vendor support sitting on the internet.
- get management interfaces off the public internet. no router admin panel, IP camera, or appliance management plane needs to be reachable from the whole world.
- watch for anomalous STUN and outbound proxy behavior from devices that have no reason to generate it.
- block the reported IPs and alarm on the hashes, but treat that as the floor, not the ceiling. the campaign evolves its infrastructure.
ClingSTUN is not a genius. it is a tax collector for negligence. the fix is the least glamorous work in security: knowing what you own, retiring what cannot be patched, and keeping management planes off the open internet. do that and the old-CVE scanners move on to the next person who did not.
Not sure what of yours is exposed on the public internet, or whether it is already proxying someone else’s traffic? Dark Edge runs external exposure and edge-device assessments. Book a slot with Dark Edge Consulting.
