Cling IoT Malware Masquerades as Google STUN Traffic to Hide C2 Communications

Nozomi Networks Labs describes “Cling,” an IoT botnet that exploits a critical Realtek Jungle SDK remote code execution (CVE-2021-35394) to infect routers, cameras, DVRs, and other embedded devices, establish persistence (copies to /root/.cling and /usr/local/bin/.cling and hijacks wget), and use a novel STUN-based C2 channel that encodes commands in the STUN transaction ID while spoofing or appearing to use public STUN servers (including apparent Google STUN addresses); the report provides IOCs (SHA-1s, loader URLs, a suspected colluding STUN server IP, and file paths) and recommends patching, isolation, and hunting for STUN traffic with zeroed transaction IDs and .cling/wget artifacts.