ClingSTUN Linux Backdoor Turns Unpatched IoT Devices Into Proxy Nodes

A Linux proxy backdoor named ClingSTUN is exploiting known vulnerabilities in internet-facing Internet of Things devices to turn compromised systems into remotely controlled proxy nodes. InfoSecurity Magazine, Dark Reading, and Hackread all report that the malware targets unpatched flaws, while InfoSecurity Magazine and Dark Reading add that it abuses legitimate public STUN servers to keep communications reachable and obscured. [1][2][4]

According to Dark Reading and Hackread, the malware campaign targets a total of 24 known vulnerabilities. InfoSecurity Magazine reported that research from FortiGuard Labs, published on October 5, tracked the campaign across three distinct phases using different download servers. The first phase relied on CVE-2022-36553 in Hytec Inter routers, while the second phase expanded to CVE-2025-34035 in EnGenius IoT cloud services and CVE-2024-23625 in D-Link UPnP services. [1][2][4]

As cybersecuritynews.com reported, the malware also disguises its control traffic as Google STUN traffic to control compromised devices. Ipidea, a Chinese company, previously operated a large residential proxy network that controlled millions of consumer devices for proxy use, according to Wikipedia. [3][5]

As FTMQ Security reported earlier, the malware continues to abuse public infrastructure to maintain persistent remote access across infected endpoints. Organizations are advised to apply security patches for exposed IoT hardware to block initial exploitation vectors. [1][6]