[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fawo97ZjyDObB6xBJFnrjNYBlC6x81FUp5I2-0uR6Wrg":3},{"article":4,"iocs":54,"watch_terms":58,"solutions":59,"lesson":160},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"fa71edb4-e304-4f38-b85e-b364b200bded","Linux Backdoor Abuses STUN Protocol, Exploits Dozens of Flaws","linux-backdoor-abuses-stun-protocol-exploits-dozens-of-flaws-d968cf","ClingSTUN operates as a back-connect proxy backdoor, sets up persistence, and contains exploits for self-propagation. The post Linux Backdoor Abuses STUN Protocol, Exploits Dozens of Flaws appeared first on SecurityWeek.","A new Linux backdoor named ClingSTUN has been discovered that functions as a back-connect proxy. It exploits numerous vulnerabilities for initial access and self-propagation, targeting devices from various manufacturers. ClingSTUN also uses the STUN protocol to establish connections and maintain NAT connectivity, making it harder to detect as malicious infrastructure.","Linux backdoor ClingSTUN abuses STUN protocol and exploits dozens of vulnerabilities for propagation.","https:\u002F\u002Fwww.securityweek.com\u002Flinux-backdoor-abuses-stun-protocol-exploits-dozens-of-flaws\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2025\u002F02\u002FLinux-malware.jpeg","2026-10-05T13:00:00+00:00","2026-10-05T14:00:22.178949+00:00",8,[17,20,23,25,27,29],{"name":18,"type":19},"STUN protocol","technology",{"name":21,"type":22},"Avtech","product",{"name":24,"type":22},"EnGenius",{"name":26,"type":22},"D-Link",{"name":28,"type":22},"Hytec",{"name":30,"type":22},"Ivanti","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":31,"icon":33,"name":34,"slug":35},null,"Malware","malware",[37,42,47,49],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":48},{"id":31,"icon":33,"name":34,"slug":35},{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[55],{"type":35,"value":56,"context":57},"ClingSTUN","Name of the discovered Linux backdoor",[21,24,26],{"controls":60,"vendors":148},[61,90,119],{"slug":62,"name":63,"problem":64,"products":65},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[66,74,82],{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"slug":91,"name":92,"problem":93,"products":94},"patch-management","Automated patch management","Known holes get closed in days, not months.",[95,103,111],{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"slug":120,"name":121,"problem":122,"products":123},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[124,132,140],{"vendor_slug":125,"vendor_name":126,"vendor_logo":127,"product_slug":128,"product_name":129,"url":130,"description":131},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":133,"vendor_name":134,"vendor_logo":135,"product_slug":136,"product_name":137,"url":138,"description":139},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":141,"vendor_name":142,"vendor_logo":143,"product_slug":144,"product_name":145,"url":146,"description":147},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",[149,155],{"slug":150,"name":151,"logo_path":152,"roles":153},"fortinet","Fortinet","\u002Fvendor-logos\u002Ffortinet.png",[154],"reported_by",{"slug":156,"name":30,"logo_path":157,"roles":158},"ivanti","\u002Fvendor-logos\u002Fivanti.png",[159],"affected",{"slug":161,"title":162,"body":163,"framework_refs":164,"framework_notes":176},"clingstun-linux-backdoor-exploits-dozens-of-flaws-via-stealthy-stun-protocol","ClingSTUN Linux Backdoor Exploits Dozens of Flaws via Stealthy STUN Protocol","The ClingSTUN backdoor highlights the severe risk of leaving known vulnerabilities unpatched across Linux-based devices from multiple manufacturers, allowing attackers to gain initial access and self-propagate across networks. By abusing the legitimate STUN protocol — typically used for NAT traversal — the malware effectively camouflages its command-and-control traffic as benign network activity, complicating detection efforts. This multi-vulnerability exploitation approach means that even a single unpatched device can serve as a foothold for broader network compromise. The combination of stealth, self-propagation, and protocol abuse underscores why timely patching, network segmentation, and protocol-level monitoring are non-negotiable security fundamentals.",[165,166,167,168,169,170,171,172,173,174,175],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management","NIST SI-2: Flaw Remediation","NIST SC-7: Boundary Protection","NIST SI-3: Malicious Code Protection","NIST CA-7: Continuous Monitoring","MITRE ATT&CK T1190: Exploit Public-Facing Application","MITRE ATT&CK T1572: Protocol Tunneling","MITRE ATT&CK T1210: Exploitation of Remote Services",{}]