Realtek Jungle SDK Exploit Attempts Deliver Cling Botnet With STUN-Based C2

**Cling/ClingSTUN** is an actively exploited botnet that leverages a now-patched critical Realtek Jungle SDK RCE (CVE-2021-35394) and numerous other device vulnerabilities to gain persistence on routers, DVRs and similar devices; it abuses public STUN infrastructure and the STUN transaction ID field for covert C2, supports worm-like propagation, backconnect proxying/tunneling and DDoS, and has been observed in the wild by Nozomi Networks and Fortinet.