Linux Backdoor Abuses STUN Protocol, Exploits Dozens of Flaws

1. Executive summary

FortiGuard Labs has documented a Linux backdoor, ClingSTUN, that turns infected hosts into back-connect proxies tunnelled over the legitimate STUN protocol and carries hardcoded exploits for roughly two dozen vulnerabilities used for initial access and self-propagation. The malware sets boot-sequence persistence, kills competing malware processes, and fetches architecture-specific payloads for AMD X86-64, ARM, Intel 80386, MIPS R3000 and PowerPC. No CVSS scores, CVE identifiers, CISA KEV entries or MITRE ATT&CK actor profiles were resolved for this item, so severity cannot be scored from verified reference data and the operator attribution is unconfirmed. EMEA financial services exposure is concentrated in internet-facing edge and IoT devices (routers, IP cameras, DVRs, print servers) from the named vendors, and in the fact that ClingSTUN's command-and-control rides on public STUN servers that most egress filters do not block. The single-source nature of this reporting is a material caveat: treat the vendor list and exploit portfolio as indicative, not exhaustive.

2. Regulatory framing

No other article in the regulatory reference is directly engaged by the facts in this item. DORA Art. 17, 18 and 19 and NIS2 Art. 23 are incident-management and reporting obligations that attach once a firm has a confirmed incident; nothing in the source material establishes that any EMEA financial services entity has been compromised, so those articles are not triggered by this advisory itself.

3. Technical analysis & attack chain

ClingSTUN is a back-connect proxy backdoor for Linux. FortiGuard Labs observed three variants of the same botnet, all sharing the same behavioural set: killing competitors' processes, terminating a watchdog timer, establishing persistence, and executing remote commands. The confirmed chain, as described in the source, is:

1. Initial access via exploitation of one of roughly two dozen vulnerabilities in Avtech, EnGenius, D-Link, Hytec, Ivanti, Lantronix, Linear, MeiG, Realtek, Sunhillo, Tenda and TP-Link products. The operators were seen exploiting these indiscriminately, and the source states they appear to be expanding the exploit portfolio.
2. A downloader runs on the victim host and fetches the ClingSTUN payload matching the host architecture. Supported architectures are AMD X86-64, ARM, Intel 80386, MIPS R3000 and PowerPC.
3. The backdoor copies itself to two hidden files with executable permissions and appends startup commands to three system initialization scripts, giving execution during the boot sequence.
4. ClingSTUN opens a UDP socket, binds to a random local port, and sends standard STUN binding requests to public STUN servers to establish endpoint connections and maintain NAT traversal.
5. After the STUN binding exchanges complete, the implant periodically sends its group identifier and mapped-port list to the same STUN endpoints. FortiGuard states that no separate coordination-server registration was identified on this path, meaning the STUN exchange itself carries the coordination data.
6. The implant listens for specific packets that let operators run remote code execution on the host and trigger the self-propagation mechanism.
7. Self-propagation uses hardcoded exploits for seven vulnerabilities in China Mobile, KGUARD, Linksys, LB-LINK, MVPower, Realtek and TBK products.

The command-and-control design is the part that changes defender behaviour. ClingSTUN does not contact a dedicated C2 server. It uses legitimate public STUN servers to discover its external IP address and port mapping, then keeps that NAT binding alive with recurring keepalive traffic. FortiGuard's guidance is explicit that these third-party STUN services should not be automatically classified as attacker-controlled infrastructure, and that STUN activity should be assessed alongside suspicious process behaviour, unexpected UDP connections and recurring keepalive traffic rather than blocked on sight. A blanket block on STUN will break legitimate real-time communications (WebRTC, VoIP, conferencing) and will not reliably stop the implant, which can use any reachable public STUN endpoint.

The source does not give the specific CVE identifiers behind either exploit set, the exact vulnerable product versions, the hidden file paths, the names of the three initialization scripts, the group identifier format, the packet structure the implant listens for, or any file hashes. Those gaps matter for detection engineering and are called out here rather than filled with assumption.

Confidence caveats. This entire technical picture rests on a single vendor report, FortiGuard Labs, relayed by SecurityWeek. The vendor list, the count of roughly two dozen initial-access flaws and seven propagation flaws, and the three-variant observation are single-sourced and should be verified against telemetry before any enforcement action. No MITRE ATT&CK profile for the operator was resolved in the verified reference data, so no actor attribution is made here; the source names no threat group.

4. Mitigation & containment

P1, within 24 hours:

• Inventory internet-facing and internal Linux hosts and embedded devices from the named vendors (Avtech, EnGenius, D-Link, Hytec, Ivanti, Lantronix, Linear, MeiG, Realtek, Sunhillo, Tenda, TP-Link, plus the propagation set: China Mobile, KGUARD, Linksys, LB-LINK, MVPower, TBK). Any device in this list that is end-of-life or cannot be patched should be isolated from the corporate network or decommissioned.
• Hunt for the persistence pattern: two hidden files with executable permissions plus appended startup commands in three system initialization scripts. Check /etc/rc.local, /etc/init.d/, /etc/rc*.d/ and systemd unit directories for unexpected entries, and diff initialization scripts against a known-good baseline. The source does not name the exact scripts or file paths, so the hunt must be pattern-based rather than path-based.
• Review egress for UDP traffic to public STUN servers (STUN binding requests, typically UDP 3478 and 5349, though the source does not confirm the port). Correlate any such traffic with the process that generated it. Do not block STUN wholesale; alert on it from processes that have no legitimate real-time communications role.
• Check for unexpected processes terminating other processes or interacting with watchdog timers on embedded Linux devices.

P2, within 72 hours:

• Patch or firmware-update every named device class to the vendor's current release. Where the vendor has published an advisory for a specific flaw, apply it; where no fix exists, apply compensating network controls (management interface off the internet, ACLs restricting access to trusted ranges).
• Restrict outbound UDP from server and IoT VLANs to an allowlist of destinations the business actually needs. This is the control that most directly degrades ClingSTUN's NAT-traversal and coordination path without breaking WebRTC or VoIP for user endpoints.
• Enable process-level logging on Linux hosts (auditd execve, or the EDR equivalent) so that the downloader-to-payload sequence and the hidden-file copy are visible.

P3, within 7 days:

• Add the behavioural detections in §6 to production and tune against a week of baseline traffic.
• Review the ICT third-party register to record the dependency on public STUN services as an abused legitimate service, per the DORA Art. 28 row in §2.
• Re-run the device inventory quarterly; the source states the operators appear to be expanding their exploit portfolio, so the vulnerable-product list will change.

5. Indicators of compromise

No atomic indicators (hashes, domains, IP addresses, file paths, registry keys) are present in the source material. The source describes behaviour only.

Behavioural indicators:

No copyable indicator block is provided because the source contains no machine-pivotable atomic indicators.

6. Detection

The source provides no file hashes, no filenames, no registry keys and no command-line flags. It does provide distinctive behavioural artefacts: the STUN binding and keepalive pattern, the group-identifier transmission, the hidden-file persistence and the initialization-script modification. A YARA rule cannot be written responsibly here, because every string that would go into it (CVE identifiers, vendor names, the malware name) is reporting about the threat rather than an artefact of the threat itself. A Sigma rule is appropriate for the network and process behaviour.

title: ClingSTUN Backdoor STUN-Based C2 and Persistence Behaviour
id: 8f3c1a72-4d5e-4b9a-9c21-7e6f0a2b1d44
status: experimental
description: Detects behavioural patterns associated with the ClingSTUN Linux backdoor, including STUN binding traffic from non-real-time-communications processes and modification of system initialization scripts. Single-sourced from FortiGuard Labs reporting; tune before production use.
author: Adverse Trace
date: 2026-10-05
references:

  - https://www.securityweek.com/linux-backdoor-abuses-stun-protocol-exploits-dozens-of-flaws/
logsource:
  category: network_connection
  product: linux
detection:
  selection_stun_udp:
    DestinationPort:

      - 3478
      - 5349
    Protocol: udp
  filter_legitimate_rtc:
    Image|endswith:

      - '/chrome'
      - '/firefox'
      - '/zoom'
      - '/teams'
      - '/slack'
  condition: selection_stun_udp and not filter_legitimate_rtc
falsepositives:

  - Legitimate WebRTC, VoIP and conferencing clients not covered by the filter list
  - Other applications using STUN for NAT traversal
level: medium
---
title: Modification of Linux System Initialization Scripts
id: 2b9e4c11-6a3d-4f88-b0e5-1c7d9a4e5f22
status: experimental
description: Detects writes to system initialization scripts consistent with ClingSTUN persistence, which appends startup commands to three initialization scripts. Single-sourced; baseline expected changes before enabling.
author: Adverse Trace
date: 2026-10-05
references:

  - https://www.securityweek.com/linux-backdoor-abuses-stun-protocol-exploits-dozens-of-flaws/
logsource:
  category: file_event
  product: linux
detection:
  selection_paths:
    TargetFilename|startswith:

      - '/etc/rc.local'
      - '/etc/init.d/'
      - '/etc/rc'
      - '/etc/systemd/system/'
  condition: selection_paths
falsepositives:

  - Package installation and upgrade activity
  - Configuration management tooling (Ansible, Puppet, Chef)
level: medium

7. Sources

• SecurityWeek, "Linux Backdoor Abuses STUN Protocol, Exploits Dozens of Flaws", https://www.securityweek.com/linux-backdoor-abuses-stun-protocol-exploits-dozens-of-flaws/, 2026-10-05. Reporting attributed to FortiGuard Labs; the underlying FortiGuard Labs publication was not provided and is not cited here.

8. Adverse Trace position

We assess this as a medium-confidence, single-sourced item. The technical mechanism is coherent and the STUN-abuse design is operationally significant because it defeats naive egress blocklisting, but no CVSS score, CVE identifier, CISA KEV entry or MITRE ATT&CK actor profile was resolved in our verified reference data, so we are not assigning a severity rating and we are not attributing the activity to any named group. Client impact for EMEA financial services is real but bounded: the exposure is internet-facing edge and IoT devices from the named vendors, plus any Linux host that can reach a public STUN server on UDP. We will request the underlying FortiGuard Labs report to obtain the CVE identifiers, the hidden file paths, the initialization script names and any hashes, and we will reissue this advisory with scored severity and atomic indicators if that material is obtained. Until then, clients should treat the vendor list as indicative and run the P1 hunts in §4 against their own telemetry rather than waiting for a confirmed CVE list.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.