Linux Backdoor Abuses STUN Protocol, Exploits Dozens of Flaws
Linux backdoor ClingSTUN abuses STUN protocol and exploits dozens of vulnerabilities for propagation.
A new Linux backdoor named ClingSTUN has been discovered that functions as a back-connect proxy. It exploits numerous vulnerabilities for initial access and self-propagation, targeting devices from various manufacturers. ClingSTUN also uses the STUN protocol to establish connections and maintain NAT connectivity, making it harder to detect as malicious infrastructure.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Avtech?
Get an email when a new story names Avtech, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe ClingSTUN backdoor highlights the severe risk of leaving known vulnerabilities unpatched across Linux-based devices from multiple manufacturers, allowing attackers to gain initial access and self-propagate across networks. By abusing the legitimate STUN protocol — typically used for NAT traversal — the malware effectively camouflages its command-and-control traffic as benign network activity, complicating detection efforts. This multi-vulnerability exploitation approach means that even a single unpatched device can serve as a foothold for broader network compromise. The combination of stealth, self-propagation, and protocol abuse underscores why timely patching, network segmentation, and protocol-level monitoring are non-negotiable security fundamentals.
What helps against this
How we list vendors
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — ClingSTUN