[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fFW_7knHcbJdDYjpzByZONSwpST7Ah17MfTs9AVuVYUA":3},{"article":4,"iocs":38,"watch_terms":39,"solutions":40,"lesson":136},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"025b89df-7c42-4e88-b8b6-7136e7a638c1","ClingSTUN Turns Vulnerable IoT Devices Into Proxy Nodes","clingstun-turns-vulnerable-iot-devices-into-proxy-nodes-21b302","The Linux backdoor exploits 24 known flaws to compromise IoT devices and uses legitimate public STUN servers to obscure communications.","A new Linux backdoor, dubbed ClingSTUN, has been discovered that targets vulnerable IoT devices. It exploits 24 known vulnerabilities to gain control and then leverages legitimate public STUN servers to mask its command-and-control communications, effectively turning compromised devices into proxy nodes for malicious activities.","ClingSTUN backdoor exploits 24 flaws to turn IoT devices into proxy nodes.","https:\u002F\u002Fwww.darkreading.com\u002Fiot\u002Fclingstun-vulnerable-iot-devices-proxy-nodes","https:\u002F\u002Feu-images.contentstack.com\u002Fv3\u002Fassets\u002Fblt6d90778a997de1cd\u002Fblt233af9606aed0447\u002F6ac404da1ba7958c12dbbcbc\u002Fstungun_Nikola_Fific_shutterstock.jpg?width=720&quality=80&disable=upscale","2026-10-05T21:25:08+00:00","2026-10-05T22:00:11.245893+00:00",7,[17],{"name":18,"type":19},"IoT","technology","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":20,"icon":22,"name":23,"slug":24},null,"Malware","malware",[26,28,33],{"category":27},{"id":20,"icon":22,"name":23,"slug":24},{"category":29},{"id":30,"icon":22,"name":31,"slug":32},"d6f63bb8-0801-486a-be7f-171400700454","IoT\u002FOT","iot-ot",{"category":34},{"id":35,"icon":22,"name":36,"slug":37},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[],{"controls":41,"vendors":129},[42,71,100],{"slug":43,"name":44,"problem":45,"products":46},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[47,55,63],{"vendor_slug":48,"vendor_name":49,"vendor_logo":50,"product_slug":51,"product_name":52,"url":53,"description":54},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":56,"vendor_name":57,"vendor_logo":58,"product_slug":59,"product_name":60,"url":61,"description":62},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"slug":72,"name":73,"problem":74,"products":75},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[76,84,92],{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":96,"product_name":97,"url":98,"description":99},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"slug":101,"name":102,"problem":103,"products":104},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[105,113,121],{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",{"vendor_slug":114,"vendor_name":115,"vendor_logo":116,"product_slug":117,"product_name":118,"url":119,"description":120},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",[130],{"slug":131,"name":132,"logo_path":133,"roles":134},"google","Google","\u002Fvendor-logos\u002Fgoogle.png",[135],"reported_by",{"slug":137,"title":138,"body":139,"framework_refs":140,"framework_notes":151},"clingstun-hijacks-unpatched-iot-devices-as-stealthy-proxy-nodes","ClingSTUN Hijacks Unpatched IoT Devices as Stealthy Proxy Nodes","ClingSTUN exploits 24 known, publicly documented vulnerabilities in IoT devices, meaning patches or mitigations already existed but were never applied. By chaining these unpatched weaknesses together, attackers gain persistent backdoor access and repurpose the devices as proxy nodes — obscuring malicious command-and-control traffic behind legitimate STUN server communications. This dual threat — unpatched devices combined with protocol-abuse for C2 obfuscation — makes detection significantly harder for defenders relying solely on traffic blocklists. The incident underscores that IoT devices are rarely managed with the same security rigor as traditional IT assets, leaving entire network segments silently compromised.",[141,142,143,144,145,146,147,148,149,150],"CIS Control 1 — Inventory and Control of Enterprise Assets","CIS Control 7 — Continuous Vulnerability Management","CIS Control 12 — Network Infrastructure Management","CIS Control 13 — Network Monitoring and Defense","NIST SP 800-213 — IoT Device Cybersecurity Guidance","NIST SI-2 — Flaw Remediation","NIST SC-7 — Boundary Protection","NIST SI-4 — System Monitoring","NIST IR-4 — Incident Handling","IEC 62443-3-3 — SR 3.4 Software and Information Integrity",{}]