Hackers Exploit 24 IoT Vulnerabilities to Install ClingSTUN Linux Backdoor

FortiGuard Labs identified ClingSTUN, a Linux backdoor that exploits numerous known vulnerabilities across multiple IoT and networking vendors to install multi-architecture malware that persists across reboots. The backdoor binds a UDP socket and uses legitimate public STUN servers to learn NAT mappings and relay keepalives, enabling attackers to control devices as proxy nodes, execute remote commands, terminate competing malware, interfere with watchdogs, and scan for additional vulnerable systems; FortiGuard recommends inspecting exposed devices, firmware updates, and isolating end-of-life equipment.