[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fxhyLE630YWv5AdFFboXn0-dyGHaPPHkwsXeWzEYMOH8":3},{"article":4,"iocs":44,"watch_terms":48,"solutions":49,"lesson":139},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":22,"category":23,"article_tags":26},"ac7cfc27-34e3-4d2e-a6f5-bea29226eb4a","Hackers Exploit 24 IoT Vulnerabilities to Install ClingSTUN Linux Backdoor","hackers-exploit-24-iot-vulnerabilities-to-install-clingstun-linux-backdoor-3e4206","Meet ClingSTUN, a new Linux backdoor that exploits IoT vulnerabilities, gives attackers remote command access and turns infected devices into proxy nodes.","A new Linux backdoor named ClingSTUN has been identified, leveraging the exploitation of 24 distinct IoT vulnerabilities. Once installed, ClingSTUN grants attackers remote command execution capabilities and repurposes the compromised devices into proxy nodes for further malicious activities.","Hackers exploit 24 IoT vulnerabilities to install ClingSTUN Linux backdoor.","https:\u002F\u002Fhackread.com\u002Fhackers-exploit-iot-vulnerabilities-clingstun-linux-backdoor\u002F",null,"2026-10-05T15:53:16+00:00","2026-10-05T16:01:04.152075+00:00",8,[17,20],{"name":18,"type":19},"Linux","technology",{"name":21,"type":19},"IoT","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":22,"icon":12,"name":24,"slug":25},"Malware","malware",[27,32,34,39],{"category":28},{"id":29,"icon":12,"name":30,"slug":31},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":33},{"id":22,"icon":12,"name":24,"slug":25},{"category":35},{"id":36,"icon":12,"name":37,"slug":38},"d6f63bb8-0801-486a-be7f-171400700454","IoT\u002FOT","iot-ot",{"category":40},{"id":41,"icon":12,"name":42,"slug":43},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[45],{"type":25,"value":46,"context":47},"ClingSTUN","Name of the new Linux backdoor",[],{"controls":50,"vendors":138},[51,80,109],{"slug":52,"name":53,"problem":54,"products":55},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[56,64,72],{"vendor_slug":57,"vendor_name":58,"vendor_logo":59,"product_slug":60,"product_name":61,"url":62,"description":63},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"slug":81,"name":82,"problem":83,"products":84},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[85,93,101],{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"slug":110,"name":111,"problem":112,"products":113},"ot-security","OT and industrial control system security","Factory, building and utility control systems get visibility and protection.",[114,122,130],{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"claroty","Claroty","\u002Fvendor-logos\u002Fclaroty.png","xdome","Claroty xDome","https:\u002F\u002Fclaroty.com\u002Findustrial-cybersecurity\u002Fxdome","Asset inventory, vulnerability management and threat detection for industrial networks.",{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"dragos","Dragos","\u002Fvendor-logos\u002Fdragos.png","dragos-platform","Dragos Platform","https:\u002F\u002Fwww.dragos.com\u002Fcybersecurity-platform\u002F","OT asset visibility, threat detection and response guidance for industrial environments.",{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-ot-security","Tenable OT Security","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fot-security","Asset inventory, vulnerability and threat detection for industrial networks.",[],{"slug":140,"title":141,"body":142,"framework_refs":143,"framework_notes":154},"clingstun-backdoor-exploits-24-iot-flaws-to-hijack-devices","ClingSTUN Backdoor Exploits 24 IoT Flaws to Hijack Devices","Attackers are actively exploiting a broad set of 24 known IoT vulnerabilities to deploy the ClingSTUN Linux backdoor, granting themselves persistent remote command execution on compromised devices. The scale of vulnerabilities exploited highlights a systemic failure in IoT patch management and vulnerability tracking — many IoT devices ship with minimal update mechanisms and are left unpatched indefinitely. Once compromised, these devices are repurposed as proxy nodes, effectively turning victim infrastructure into an attacker-controlled relay network. This matters because unmanaged IoT devices on corporate or home networks create silent pivot points that are extremely difficult to detect and evict without proper segmentation and monitoring in place.",[144,145,146,147,148,149,150,151,152,153],"CIS Control 1 – Inventory and Control of Enterprise Assets","CIS Control 7 – Continuous Vulnerability Management","CIS Control 12 – Network Infrastructure Management","CIS Control 13 – Network Monitoring and Defense","NIST SP 800-213 – IoT Device Cybersecurity Guidance","NIST SI-2 – Flaw Remediation","NIST SC-7 – Boundary Protection","NIST IR-4 – Incident Handling","NIST SP 800-82 – Guide to ICS\u002FOT Security (applicable IoT principles)","IEC 62443-3-3 – System Security Requirements and Security Levels",{}]