Realtek Jungle SDK Exploit Attempts Deliver Cling Botnet With STUN-Based C2
Cling botnet exploits patched Realtek Jungle SDK flaw, uses STUN protocol for C2.
Threat actors have been observed exploiting CVE-2021-35394, a critical RCE flaw in Realtek Jungle SDK, to deploy the Cling botnet malware. Cling is notable for repurposing STUN (Session Traversal Utilities for NAT) protocol traffic into a command-and-control channel, making malicious activity appear as legitimate NAT-traversal communication. The malware embeds exploit logic for multiple router and DVR vulnerabilities and achieves persistence through various mechanisms including self-copying and wget binary replacement.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Realtek?
Get an email when a new story names Realtek, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonCVE-2021-35394, a critical remote code execution vulnerability in the Realtek Jungle SDK, remains actively exploited years after its disclosure, highlighting a persistent failure to patch embedded and IoT devices at scale. Threat actors are leveraging this unpatched flaw to deploy the Cling botnet, which cleverly disguises its command-and-control traffic as legitimate STUN protocol communication, making detection significantly harder. This matters because millions of consumer routers, DVRs, and networking appliances share the same underlying SDK, creating a massive, largely unmanaged attack surface. The malware's persistence mechanisms — including binary replacement — mean that even a factory reset may be insufficient to fully remediate infected devices, compounding the risk for home and enterprise networks alike.
What helps against this
How we list vendors
- Automated patch management
Known holes get closed in days, not months.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Network detection and response (NDR)
Attackers moving between systems inside the network get seen.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2021-35394
- cve — CVE-2014-8361
- cve — CVE-2016-10372
- cve — CVE-2016-20016
- cve — CVE-2023-26801
- cve — CVE-2023-41011
- cve — CVE-2024-3721
- cve — CVE-2025-34037
- malware — Cling
- ip — 145.249.115.184