ClingSTUN Malware Turns Unpatched IoT Devices Into Proxy Nodes

A Linux proxy backdoor has been observed exploiting known, unpatched flaws in internet-facing IoT devices and abusing legitimate public STUN servers to keep compromised systems reachable as remotely controlled proxy nodes.

FortiGuard Labs, which dubbed the malware ClingSTUN, said in research published on October 5 that it tracked the campaign across three periods, each with a different download server.

The operators then spread the malware through command injection flaws in Linear, Realtek, TP-Link, AVTECH and D-Link devices.

STUN Traffic Blends With VoIP and WebRTC ClingSTUN works as a back-connect proxy.

Read more on IoT malware: New Mirai-Based Linux Botnet 'Evooo1Bot' Turns Victims Into Proxies Defenders Weigh Containment Against Patching Louis Eichenbaum, federal CTO at ColorTokens warned.