ClingSTUN Linux Backdoor Abuses Public STUN Infrastructure

Fortinet researchers describe ClingSTUN, a Linux backdoor that compromises unpatched IoT and router devices across multiple vendors, installs multi-architecture payloads, establishes persistence and evasion (watchdog disablement, PID 1 metadata hiding), and abuses legitimate public STUN servers to discover NAT mappings and blend C2 traffic with normal VoIP/WebRTC communications while using outbound connections to fetch and execute commands.