ClingSTUN Linux Backdoor Abuses Public STUN Infrastructure
Fortinet, Monday, October 5th, 2026
FortiGuard Labs analyzes ClingSTUN, a Linux backdoor that exploits unpatched devices and hides its traffic using public STUN servers.
FortiGuard Labs has been tracking ClingSTUN, a Linux back-connect proxy backdoor that exploits known, unpatched vulnerabilities in internet-facing IoT devices and turns infected systems into remotely controlled proxy nodes.
The malware abuses public STUN (Session Traversal Utilities for NAT) servers to discover mapped IP addresses and ports, maintain NAT bindings and improve connectivity to operators, so its traffic blends in with normal VoIP and WebRTC.
The post gives a technical analysis of its execution flow and stresses device inventory, prompt patching and limiting internet exposure.