ClingSTUN Malware Compromises Unpatched IoT Devices as Proxy Nodes

A Linux proxy backdoor known as ClingSTUN is exploiting known flaws in internet-facing internet-of-things devices to convert them into remotely controlled proxy nodes, according to reports from Dark Reading, InfoSecurity Magazine, and Hackread. InfoSecurity Magazine reported that FortiGuard Labs published research on October 5 detailing the campaign. [1][2][4]

Dark Reading and Hackread both report that the malware exploits 24 known vulnerabilities to compromise devices. The attackers use legitimate public STUN servers to hide their communications and maintain access, according to Dark Reading and InfoSecurity Magazine. Cybersecuritynews.com reported that the malware disguises its traffic as Google STUN communications. [1][2][3][4]

InfoSecurity Magazine reported that FortiGuard Labs tracked the operation across three distinct periods, with each phase using a different download server. The initial stage lasted two days and targeted CVE-2022-36553 in Hytec Inter routers, before attackers expanded to exploit additional flaws including CVE-2025-34035 in EnGenius cloud services. [2]

In computer networking, a proxy server functions as an intermediary application between a requesting client and the server supplying the resource. [5]