ClingSTUN Turns Vulnerable IoT Devices Into Proxy Nodes
ClingSTUN backdoor exploits 24 flaws to turn IoT devices into proxy nodes.
A new Linux backdoor, dubbed ClingSTUN, has been discovered that targets vulnerable IoT devices. It exploits 24 known vulnerabilities to gain control and then leverages legitimate public STUN servers to mask its command-and-control communications, effectively turning compromised devices into proxy nodes for malicious activities.
AI summary of the linked source. Not reviewed by an editor. How this works
The lesson from this incident
Full lessonClingSTUN exploits 24 known, publicly documented vulnerabilities in IoT devices, meaning patches or mitigations already existed but were never applied. By chaining these unpatched weaknesses together, attackers gain persistent backdoor access and repurpose the devices as proxy nodes — obscuring malicious command-and-control traffic behind legitimate STUN server communications. This dual threat — unpatched devices combined with protocol-abuse for C2 obfuscation — makes detection significantly harder for defenders relying solely on traffic blocklists. The incident underscores that IoT devices are rarely managed with the same security rigor as traditional IT assets, leaving entire network segments silently compromised.
What helps against this
How we list vendors
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Network detection and response (NDR)
Attackers moving between systems inside the network get seen.