ClingSTUN Malware Turns Unpatched IoT Devices Into Proxy Nodes

**ClingSTUN** is an active Linux proxy backdoor campaign observed by FortiGuard Labs that compromises internet-facing IoT devices by chaining multiple known, unpatched vulnerabilities (dozens of CVEs across vendors) and abuses legitimate public STUN servers to keep NAT mappings open and operate compromised hosts as remote proxy nodes; the malware includes persistence, process-hiding, competing-process termination, hard-coded exploits for further spread, and detection recommendations (monitor STUN/UDP keepalives, suspicious processes, inventory and patching/isolation of vulnerable devices).