ClingSTUN Turns Vulnerable IoT Devices Into Proxy Nodes

Researchers identified a Linux IoT malware named ClingSTUN that leverages at least 24 known device vulnerabilities to gain access and uses public STUN servers to discover external network mappings and obscure operator infrastructure; once installed it establishes persistence, carries additional hard-coded exploits to spread, and can be used as a malicious proxy, creating risks to enterprise IP reputation, bandwidth, and internal network reachability. Mitigations recommended include inventorying impacted models/firmware, applying vendor updates, removing direct Internet exposure where possible, network segmentation, restricting management access, and monitoring outbound STUN-like behavior that deviates from a device's expected role.