4 Min Read

Source: Nikola Fific via Shutterstock

Researchers have uncovered a new Linux malware strain that exploits a growing list of known vulnerabilities in Internet of Things (IoT) devices to maintain a persistent foothold on enterprise networks.

What makes the malware especially noteworthy is its use of legitimate public STUN servers to help maintain connectivity with compromised devices, allowing the attackers to obscure their infrastructure in otherwise legitimate Internet traffic. STUN is a protocol that helps devices behind firewalls and NAT connect with each other over the Internet.

Malware Targets a Growing List of IoT Vulnerabilities

Fortinet’s FortiGuard Labs researchers identified the malware, which they have dubbed "ClingSTUN," after tracking attacks targeting at least 24 known vulnerabilities in IoT devices. The vulnerabilities affect a wide range of Internet-connected devices including routers, network equipment, surveillance systems, and industrial systems from manufacturers such as D-Link, Realtek, Ivanti, and TP-Link.

The oldest of the set is a long-patched command injection vulnerability from 2021 (CVE-2021-36380) in Sunhillo SureLine surveillance data distribution software used by the FAA and other aviation authorities. The most recent is a command injection flaw from earlier this year (CVE-2026-36356) that affects MeiG Smart FORGE_SLT711 devices.

FortiGuard analyst Vincent Li said threat actors were deploying ClingSTUN in multiple attack waves using a rapidly expanding list of vulnerabilities to gain access to exposed devices. In the attacks FortiGuard observed, the malware used legitimate public STUN servers as a kind of network middleman to figure out how the infected device appeared on the Internet and which ports were reachable from outside, Li wrote.

Leveraging Legitimate STUN Servers

ClingSTUN periodically sent that information back to the STUN servers. FortiGuard did not find a traditional command-and-control server involved in this process and has not determined exactly how the attackers use the connection information to communicate with infected devices. "No separate coordination-server registration was identified in this path, and how the operator obtains the external mapping and delivers control traffic through NAT remains unverified," Li said.

Once installed, ClingSTUN establishes persistence on the compromised system. In addition to its persistence mechanism the malware also includes hard-coded exploits for seven additional vulnerabilities that it can use to spread from an infected device to other vulnerable IoT systems.

The flaws are separate from the 24 that enable initial access and affect devices from Realtek, MVPower, TBK, Linksys, LB-LINK, China Mobile, and KGUARD. The oldest of these vulnerabilities is CVE-2014-8361 from 2014 in a Realtek device and the most recent is CVE-2026-87827, a remote code execution vulnerability in KGUARD DVR from earlier this year.

In comments to Dark Reading, Li says ClingSTUN demonstrates how vulnerable Internet-facing Linux and IoT devices can become infrastructure for malicious proxy operations. "Its use of multiple vulnerabilities for delivery highlights the importance of maintaining an accurate device inventory, reducing unnecessary Internet exposure, and promptly updating firmware and software," Li says. "Enterprises should also monitor outbound communications from these devices."

A device that ClingSTUN compromises can serve as intermediary through which an attacker can route traffic, potentially making malicious activity appear to originate from the enterprise’s public IP address. "This creates risks of IP blocklisting, reputational damage, bandwidth consumption, and operational disruption," Li points out. "Depending on routing and segmentation, the device may also provide access to internal destinations it can reach."

Mitigating the Threat

ClingSTUN's use of STUN servers can make its activity hard to distinguish from legitimate use by applications and devices that need to discover their external network mappings, Li adds. Therefore, indiscriminately blocking public STUN servers to address the ClingSTUN threat could disrupt legitimate services. Detection should therefore "focus on whether the behavior fits the device's role — for example, unexpected communication with numerous STUN endpoints, multiple UDP sockets, and recurring custom messages containing a group identifier and mapped-port list," Li says.

Li adds that organizations should identity all models and firmware versions that the vulnerabilities impact and apply vendor-supported updates promptly. In situations where an organization might not be able to update immediately, they should remove direct Internet exposure or disable the vulnerable service where operationally feasible. Li also recommends that organizations restrict access to IoT devices through trusted management networks or secure gateways with MFA, while isolating them through network segmentation and limiting inbound and outbound traffic.

John Gallagher, vice president at Viakoo, says ClingSTUN is a textbook example of how operational technology (OT) and IoT devices remain the enterprise's vulnerable soft underbelly. "Threat actors don't need new zero-days when organizations still leave known vulnerabilities unpatched on network-connected edge hardware," he says.

What makes ClingSTUN dangerous isn't just the multi-architecture exploit chain but also its living-off-the-land network camouflage, Gallagher adds. "By piggybacking on legitimate, public STUN servers, the malware makes malicious traffic look like everyday VoIP and WebRTC communications while simultaneously killing watchdogs and hiding behind root processes."

Perimeter defenses and static EDR are not sufficient because many of these devices are largely invisible to them. "Until organizations bridge the gap between vulnerability discovery and automated, at-scale firmware remediation, OT/IoT assets will remain easily compromised," Gallagher says.