[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fwoisKgUyhvT_ABWoqFyDhcaoKEurQAA0h541__C1IaU":3},{"article":4,"iocs":49,"watch_terms":82,"solutions":83,"lesson":177},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"3c969e11-ad7a-449e-b4e7-59e0d416f9f5","Realtek Jungle SDK Exploit Attempts Deliver Cling Botnet With STUN-Based C2","realtek-jungle-sdk-exploit-attempts-deliver-cling-botnet-with-stun-based-c2-b5ce63","Threat actors have been observed attempting to exploit a now-patched critical security flaw impacting the Realtek Jungle software development kit (SDK) to deploy a botnet malware called Cling. \"Cling is notable not because it introduces a new propagation technique, but because it repurposes ordinary STUN behavior into a practical command-and-control channel,\" Nozomi Networks said in a report","Threat actors have been observed exploiting CVE-2021-35394, a critical RCE flaw in Realtek Jungle SDK, to deploy the Cling botnet malware. Cling is notable for repurposing STUN (Session Traversal Utilities for NAT) protocol traffic into a command-and-control channel, making malicious activity appear as legitimate NAT-traversal communication. The malware embeds exploit logic for multiple router and DVR vulnerabilities and achieves persistence through various mechanisms including self-copying and wget binary replacement.","Cling botnet exploits patched Realtek Jungle SDK flaw, uses STUN protocol for C2.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Frealtek-jungle-sdk-exploit-attempts.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEgeczuQyi5eCbsZFxILJKWiHZ8_JC8gnKqr2sExCgq_Dk-7879VVbd8qcA475L-uEn3X30CIyqn-iDilE7Sl9T5FM3XGFPU6LbyE7KUH8OpWTjlirCFq8EaY-MuielVGOXFuECLLpehX9R8HQrniMulUnAUd2f_uRbZ1Fget8hT0Tf19c1N-q06dtFpAZPj\u002Fs1600\u002Fbotnet.jpg","2026-10-05T11:46:25+00:00","2026-10-05T14:00:21.337143+00:00",9,[17,20,23,25],{"name":18,"type":19},"Realtek Jungle SDK","product",{"name":21,"type":22},"Realtek","vendor",{"name":24,"type":22},"Nozomi Networks",{"name":26,"type":27},"STUN","technology","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":28,"icon":30,"name":31,"slug":32},null,"Malware","malware",[34,39,44],{"category":35},{"id":36,"icon":30,"name":37,"slug":38},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":40},{"id":41,"icon":30,"name":42,"slug":43},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":45},{"id":46,"icon":30,"name":47,"slug":48},"d6f63bb8-0801-486a-be7f-171400700454","IoT\u002FOT","iot-ot",[50,54,57,60,63,66,69,72,75,78],{"type":51,"value":52,"context":53},"cve","CVE-2021-35394","Critical RCE in Realtek Jungle SDK (CVSS 9.8), exploited starting September 5, 2026",{"type":51,"value":55,"context":56},"CVE-2014-8361","Realtek SDK RCE, embedded in Cling malware",{"type":51,"value":58,"context":59},"CVE-2016-10372","Eir D1000 router RCE, embedded in Cling malware",{"type":51,"value":61,"context":62},"CVE-2016-20016","MVPower CCTV DVR RCE, embedded in Cling malware",{"type":51,"value":64,"context":65},"CVE-2023-26801","LB-LINK routers RCE, embedded in Cling malware",{"type":51,"value":67,"context":68},"CVE-2023-41011","FiberHome SR1041F router \u002F China Mobile HG6543C4 RCE, embedded in Cling malware",{"type":51,"value":70,"context":71},"CVE-2024-3721","TBK DVR RCE, embedded in Cling malware",{"type":51,"value":73,"context":74},"CVE-2025-34037","Linksys RCE, embedded in Cling malware",{"type":32,"value":76,"context":77},"Cling","Botnet malware using STUN protocol for C2, deployed via Realtek SDK exploitation",{"type":79,"value":80,"context":81},"ip","145.249.115.184","STUN server used for C2 communication, returns all-zero transaction ID",[21,24,18],{"controls":84,"vendors":171},[85,113,142],{"slug":86,"name":87,"problem":88,"products":89},"patch-management","Automated patch management","Known holes get closed in days, not months.",[90,97,105],{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":86,"product_name":94,"url":95,"description":96},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":106,"vendor_name":107,"vendor_logo":108,"product_slug":109,"product_name":110,"url":111,"description":112},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":114,"name":115,"problem":116,"products":117},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[118,126,134],{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":130,"product_name":131,"url":132,"description":133},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":135,"vendor_name":136,"vendor_logo":137,"product_slug":138,"product_name":139,"url":140,"description":141},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"slug":143,"name":144,"problem":145,"products":146},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[147,155,163],{"vendor_slug":148,"vendor_name":149,"vendor_logo":150,"product_slug":151,"product_name":152,"url":153,"description":154},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",{"vendor_slug":156,"vendor_name":157,"vendor_logo":158,"product_slug":159,"product_name":160,"url":161,"description":162},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",{"vendor_slug":164,"vendor_name":165,"vendor_logo":166,"product_slug":167,"product_name":168,"url":169,"description":170},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",[172],{"slug":173,"name":24,"logo_path":174,"roles":175},"nozomi-networks","\u002Fvendor-logos\u002Fnozomi-networks.png",[176],"reported_by",{"slug":178,"title":179,"body":180,"framework_refs":181,"framework_notes":193},"unpatched-realtek-sdk-flaw-fuels-cling-botnet-with-stealthy-stun-based-c2","Unpatched Realtek SDK Flaw Fuels Cling Botnet With Stealthy STUN-Based C2","CVE-2021-35394, a critical remote code execution vulnerability in the Realtek Jungle SDK, remains actively exploited years after its disclosure, highlighting a persistent failure to patch embedded and IoT devices at scale. Threat actors are leveraging this unpatched flaw to deploy the Cling botnet, which cleverly disguises its command-and-control traffic as legitimate STUN protocol communication, making detection significantly harder. This matters because millions of consumer routers, DVRs, and networking appliances share the same underlying SDK, creating a massive, largely unmanaged attack surface. The malware's persistence mechanisms — including binary replacement — mean that even a factory reset may be insufficient to fully remediate infected devices, compounding the risk for home and enterprise networks alike.",[182,183,184,185,186,187,188,189,190,191,192],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-82: Guide to ICS\u002FOT Security","NIST CSF ID.AM-1: Physical devices and systems within the organization are inventoried","NIST SI-2: Flaw Remediation","NIST SC-7: Boundary Protection","NIST IR-4: Incident Handling","OWASP IoT Top 10: I1 - Weak, Guessable, or Hardcoded Passwords \u002F I3 - Insecure Ecosystem Interfaces","IEC 62443-2-1: Security Management System for IACS","ETSI EN 303 645: Cyber Security for Consumer IoT",{}]