# Exploiting 20+ CVEs to Build Hidden Proxies: Analyzing ClingSTUN's Attack Chain

## Campaign Overview

In early October 2026, threat research experts at FortiGuard Labs announced the discovery of a large-scale Linux malware campaign called ClingSTUN. Operating as a back-connect proxy backdoor, ClingSTUN turns network edge devices, telecommunications routers, security cameras and IoT systems exposed to the Internet into proxy nodes under the full control of the attacker.

Instead of relying on fixed Command and Control (C2) servers that are easily identified and blacklisted, ClingSTUN abuses legitimate public STUN (Session Traversal Utilities for NAT) server infrastructure to implement NAT traversal, maintain port mapping, and mask control traffic as regular VoIP or WebRTC voice streams. The campaign indiscriminately exploits more than twenty published security vulnerabilities in products from a series of manufacturers including D-Link, TP-Link, Tenda, Ivanti, EnGenius, Hytec Inter, AVTECH, Realtek, Lantronix, Linear and Sunhillo. Notably, the backdoor itself also has 7 built-in vulnerability exploitation modules to automatically scan and replicate to nearby targets.

The main goal of the ClingSTUN network is not to stop at being a distributed denial of service (DDoS) attack platform, but focuses on building a residential/edge proxy infrastructure. This network allows cybercriminal groups or targeted threat actors to circulate attack traffic, bypass geo-blocking and anonymize penetration of corporate networks.

## Timeline of Events & Evolution

The ClingSTUN distribution campaign is divided into three distinct stages of evolution, demonstrating the threat actor's rapid tactical adaptation in rotating malware download infrastructure and expanding the spectrum of exploitable vulnerabilities:

| Campaign Phase | Distribution Server IP | Primary Target Vulnerabilities | Key Technical Characteristics |
| --- | --- | --- | --- |
| Phase 1 — Experimentation | `124.163.212.119` | `CVE-2022-36553` (Hytec Inter HWL-2511-SS) | Short deployment window (approximately 48 hours). Tested payload compatibility against industrial routers. |
| Phase 2 — Large-Scale Expansion | `222.223.152.97` | `CVE-2025-34035` (EnGenius Cloud), `CVE-2024-23625` (D-Link UPnP), `CVE-2021-35394` (Realtek) | Expanded exploitation coverage. The [`wget.sh`](http://wget.sh) script supports ARM, MIPS, and x86-64 architectures. Uses a list of 24 public STUN servers. |
| Phase 3 — Maturation and Optimization | `118.145.196.225` | More than 20 CVEs, including Ivanti (`CVE-2024-21887`), Lantronix (`CVE-2025-67038`), and MeiG Smart (`CVE-2026-36356`) | The downloader adds mount-point cleanup techniques involving `/proc/mounts`. The STUN server list is optimized to 13 highly reliable servers, and seven worm modules are embedded. |

## STUN Protocol Architecture and How ClingSTUN "Perforates" the Firewall

To understand the danger of ClingSTUN, it is necessary to understand why devices behind network firewalls (NAT) can be actively controlled by external attackers.

### NAT Traversal problem and the birth of STUN

Most home and business network devices use internal IP ranges (Private IP, for example 192.168.1.x). When communicating out to the Internet, the router will perform NAT (Network Address Translation): convert Private IP/Port to Public IP/Port of the router.

*   Problem: With normal traffic, the internal device is always the one who proactively sends requests out first (Outbound). But with two-way conversation applications such as VoIP voice (SIP) or video calling (WebRTC), devices outside the Internet that want to send data streams directly in will be blocked (DROP) by the NAT router because there is no connection session previously initiated.
    
*   Legal solution (STUN - RFC 5389): The STUN protocol acts as a "mirror". The device sends a lightweight Binding Request packet to the STUN server outside the Internet. The STUN server sees which Public IP and Port the packet comes from and will pack that information into the XOR-MAPPED-ADDRESS field and send it back. Thanks to that, the device knows its actual public address to communicate with partners.
    

![](https://cdn.hashnode.com/uploads/covers/6777abffdb647396c7d71de4/f7f3944c-c366-4d1a-9d5d-6be37b68510a.png align="center")

### Standard 20-byte STUN packet structure (RFC 5389)

Every STUN packet begins with a fixed binary header exactly 20 bytes long:

![](https://cdn.hashnode.com/uploads/covers/6777abffdb647396c7d71de4/ab830d14-0e45-40a4-8c91-86973b9a707b.png align="center")

*   Message Type (14 bits): 0x0001 (Binding Request).
    
*   Message Length (16 bits): 0x0000 (Minimal packet, no extended attributes).
    
*   Magic Cookie (32 bits): Required standard value 0x2112A442, used to identify the STUN packet and make the XOR key to decode the IP address.
    
*   Transaction ID (96 bits / 12 bytes): Random string used to match request and response sessions.
    

### How did ClingSTUN weaponize STUN?

*   Circumventing firewalls through legitimate traffic: ClingSTUN sends standard STUN packets to 13 - 24 reputable public STUN servers (such as Google's 74.125.250.129, Deutsche Telekom's 217.0.0.249, Sipgate...). Firewall/IPS systems normally consider this as normal VoIP voice traffic or WebRTC online meetings so they do not block it.
    
*   NAT Hole Punching: Thanks to STUN, the NAT router opens an output mapping port. ClingSTUN periodically sends Keepalive packets, causing the router to always maintain an open state for this port.
    
*   Activate Back-Connect Proxy: The operator only needs to shoot a 20-byte UDP packet to the correct public port. When receiving the command (Command 1), ClingSTUN immediately proactively opens an Outbound TCP connection to the hacker's server, ready to receive shell commands and forward proxy traffic.
    

## Attack Chain

The ClingSTUN campaign takes place through 4 coherent stages, combining remote exploitation of vulnerabilities, monopolizing device resources, hiding and maintaining a two-way connection channel:

![](https://cdn.hashnode.com/uploads/covers/6777abffdb647396c7d71de4/4eeffa6a-c385-404e-b801-d756ed8a1e82.png align="center")

1.  Remote intrusion (Initial Access): The attacker automatically scans the Internet, shoots packets exploiting known vulnerabilities (N-day Command Injection on D-Link, TP-Link, Ivanti...) to force the device to run a shell command to download the wget.sh script.
    
    ![](https://cdn.hashnode.com/uploads/covers/6777abffdb647396c7d71de4/a878f13f-afaf-4882-938a-29d7b33d907d.png align="center")
    
2.  Takeover & Clean-up: wget.sh pulls in the binary file corresponding to the chip architecture (ARM, MIPS, x86\_64). Immediately, the malware scans /proc, destroys rival botnets running in /tmp, and sends kernel intervention commands to disable the hardware Watchdog, preventing the device from rebooting itself when overloaded.
    
    ![](https://cdn.hashnode.com/uploads/covers/6777abffdb647396c7d71de4/c9402b73-8be0-445f-9abb-bfda43a896cc.png align="center")
    
3.  Persistence & Evasion: ClingSTUN inserts the boot path into the system boot files (/etc/inittab, rcS), empties the command line in memory and performs bind-mount metadata of PID 1 (init) over itself. Thanks to that, administrators who open ps or top just see it as a harmless system process.
    
    ![](https://cdn.hashnode.com/uploads/covers/6777abffdb647396c7d71de4/c952898f-9d64-4f69-8bb6-76912e38e54f.png align="center")
    
4.  "Punching" the firewall via STUN (NAT Hole Punching): Malicious code sends standard 20-byte packets to public STUN servers (Google, Sipgate...). STUN returns the public gateway address and opens a "hole" through the NAT router. ClingSTUN periodically sends Keepalive packets to keep this door open.
    
5.  Turn into Proxy & Self-Replication (Proxying & Spreading): The operator only needs to send a 20-byte packet through the corrupted NAT port to trigger malicious code to open a reverse TCP connection (Back-Connect). The device officially turns into an underground Proxy station, and activates 7 worm modules that automatically scan and spread to surrounding IoT devices.
    

## Analysis of Stealth and System Domination Techniques

In addition to STUN technology, ClingSTUN possesses very methodical design thinking to protect its existence on embedded Linux devices:

### Disable hardware Watchdog to prevent auto-restart

On IoT devices, the hardware Watchdog Timer chip will automatically reboot the device (hard reboot) if the system crashes or overloads the CPU. When ClingSTUN turns the device into a large traffic proxy, the risk of Watchdog rebooting is very high.

The malicious code directly opens the device file /dev/watchdog (or /dev/misc/watchdog) and calls the ioctl function with the flag WDIOS\_DISABLECARD (0x0001), and writes the magic character "V" to completely disable this timer.

### Hunt down and destroy rival botnets

In order to monopolize bandwidth and CPU, ClingSTUN periodically scans the /proc directory:

*   Ignore processes that belong to the same process group.
    

*   Scan /proc//exe, if found a process running from /tmp or /var/tmp will immediately send kill command -9.
    
*   Compare basename: Compare the actual filename of the executable with the arguments in /proc//cmdline. If the filenames don't match (a sign of disguising the progress of rival Mirai botnets), ClingSTUN will kill it.
    
*   In the latest version, its downloader also browses /proc/mounts, automatically unmounting virtual mount points that override the system directory and killing the corresponding process.
    

![](https://cdn.hashnode.com/uploads/covers/6777abffdb647396c7d71de4/96dc729f-8bb9-47ff-96fe-8d7c9d94cdf6.png align="center")

### High-level camouflage technique: Bind-mount Init PID 1

To fool the admin when checking the process list (ps aux, top):

*   Empty the command line: The malicious code overwrites the 0x00 bytes into the argv parameter memory area, causing the COMMAND column when viewed with the ps command to be completely empty.
    
*   Bind-mount overrides yourself: If running as root, ClingSTUN copies status files from the init process (/proc/1/stat, cmdline, status) to /tmp, then executes:
    

![](https://cdn.hashnode.com/uploads/covers/6777abffdb647396c7d71de4/d9a1ffd7-36be-4804-b6de-3329ea9f50f3.png align="center")

This behavior causes the malware's /proc/ directory to display identical parameters to the system init process (PID 1), disabling manual detection.

### Set startup mechanism (Persistence) and Self-replication (Worm)

*   Persistence: Copy yourself to /root/.cling and /usr/local/bin/.cling, then insert the initialization command into 3 boot files: /etc/inittab, /etc/init.d/rcS and /etc/rc.d/rc.boot.
    
*   Worm integrates 7 Exploit: Hard-embedded malicious code with 7 modules exploiting vulnerabilities (Realtek SDK CVE-2014-8361, MVPower DVR CVE-2016-20016, TBK DVR CVE-2024-3721, Linksys CVE-2025-34037, LB-LINK CVE-2023-26801, China Mobile CVE-2023-41011, KGUARD CVE-2026-87827) to automatically scan the network and spread to other devices without the control server giving commands.
    

![](https://cdn.hashnode.com/uploads/covers/6777abffdb647396c7d71de4/ed1b698a-7f06-4f68-9ba5-222059d15a5f.png align="center")

## Initial Penetration of Device Groups

The attacker uses an arsenal of over 20 N-day vulnerabilities (mainly Command Injection without authentication):

*   Network Devices & Routers: D-Link (DIR-859, Go-RT-AC750 - CVE-2024-23625, CVE-2024-10915, CVE-2022-37055), TP-Link (Archer AX21 - CVE-2023-1389), Tenda (AC-series - CVE-2024-46048, CVE-2024-32314...), Hytec Inter (CVE-2022-36553), EnGenius Cloud (CVE-2025-34035).
    
*   Surveillance & IoT devices: AVTECH AVM1203 (CVE-2024-7029), Linear eMerge (CVE-2019-7256), Sunhillo SureLine (CVE-2021-36380), MeiG Smart (CVE-2026-36356).
    
*   Enterprise Gateway System: Ivanti Connect Secure / Policy Secure (CVE-2024-21887, CVE-2023-46805), Lantronix EDS5000 (CVE-2025-67038).
    

## IOCs

### IP C2

*   124\[.\]163\[.\]212\[.\]119
    
*   222\[.\]223\[.\]152\[.\]97
    
*   118\[.\]145\[.\]196\[.\]225
    

### **SHA-256**

*   dc892f5013edb0aa1e61e808511387373d8d120348b5be0929621d21e6e9946a
    
*   a297eddfa7abea8d411afc0f150f8f6f30e470a77204de87e3b0815fa9bb8a84
    
*   4fbd61cb9181ebbc4fe9a6e59d3c346dc00001da48d66bd890556fc6fad22b07
    
*   121f2050e3c891b29565fd73451fff7ae60199c86eb8d79ec1eb1d9844578487
    

## **MITRE ATT&CK**

| Tactic | Technique ID | Application in ClingSTUN |
| --- | --- | --- |
| Initial Access | `T1190` | Exploits more than 20 known N-day vulnerabilities in routers, gateways, and IP cameras. |
| Execution | `T1059.004` | Executes the [`wget.sh`](http://wget.sh) shell script and arbitrary Bash commands. |
| Persistence | `T1037.004 / T1037.005` | Adds binary execution paths to startup configuration files, including `/etc/inittab` and `/etc/init.d/rcS`. |
| Defense Evasion | `T1562.001` | Attempts to disable the hardware watchdog timer through `/dev/watchdog` using `ioctl` operations. |
| Defense Evasion | `T1036.004` | Clears process command-line arguments (`argv`) and uses bind mounts involving `/proc/1` and `/proc/<pid>` to disguise process information. |
| Defense Evasion | `T1564.001` | Creates hidden files with dot-prefixed names, such as `.cling`. |
| Discovery | `T1057` | Enumerates `/proc` to identify competing botnet processes and terminate them. |
| Command and Control | `T1090` | Uses compromised devices as back-connect proxy nodes to relay network traffic. |
| Command and Control | `T1102` | Abuses public STUN servers to discover externally mapped NAT addresses and ports. |
| Lateral Movement | `T1210` | Incorporates seven exploit modules intended to propagate to other vulnerable devices on reachable networks. |

## Comments from FPT IS SOC experts

*   The Rise of Residential Proxy Networks: ClingSTUN is not about taking down targets with DDoS. The core purpose is to acquire "clean" residential network IP ranges for resale or as a springboard to hide traces for APT campaigns and financial fraud. A router device, even if it does not contain important data, is still a high-value target if it owns a clean IP that connects directly to the Internet.
    
*   Blind spot of surveillance based on IP reputation (Reputation): Malicious code communicating with STUN servers of Google or Deutsche Telekom causes all IP Blacklist filters to be completely paralyzed. The SOC team must shift to monitoring behavioral anomalies (Behavioral Analytics) — for example, detecting an IP camera or industrial control device suddenly generating UDP 3478 connections out to the Internet.
    
*   Current situation in Vietnam: Hundreds of thousands of older generation cameras and routers in Vietnam are opening ports directly to the Internet without turning on the firewall or have been discontinued by the manufacturer (End-of-Life). This is the ideal environment for ClingSTUN's network worm modules to freely spread exponentially.
    

## Link To Update Critical CVEs

| Device Group | Product Line / Vulnerability | Patch Status | Update Link / Security Advisory |
| --- | --- | --- | --- |
| Enterprise Gateway / VPN | Ivanti Connect Secure / Policy Secure  
CVE-2023-46805, CVE-2024-21887 | Patch available | 🔗 [Ivanti KB CVE-2023-46805 / CVE-2024-21887](https://forums.ivanti.com/s/article/KB-CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways)  
🔗 [Ivanti Recovery Steps](https://forums.ivanti.com/s/article/Recovery-Steps-Related-to-CVE-2023-46805-and-CVE-2024-21887?language=en_US)  
Details: [NVD CVE-2024-21887](https://nvd.nist.gov/vuln/detail/CVE-2024-21887) |
| Enterprise Gateway | Lantronix EDS5000 Device Server  
CVE-2025-67038 | Patch available (FW 2.2.0.0R1+) | 🔗 [Lantronix EDS5000 Latest Firmware](https://ltrxdev.atlassian.net/wiki/spaces/LTRXTS/pages/2538438657/Latest+Firmware+for+the+EDS5000+series+EDS5008+EDS5016+EDS5032)  
Details: [NVD CVE-2025-67038](https://nvd.nist.gov/vuln/detail/CVE-2025-67038) |
| Home / SME Wi-Fi Router | TP-Link Archer AX21 (Hardware v1/v2)  
CVE-2023-1389 (luci.stok injection) | Patch available | 🔗 \[Unverified\] [TP-Link Archer AX21 Firmware](https://www.tp-link.com/us/support/download/archer-ax21/)  
Details: [NVD CVE-2023-1389](https://nvd.nist.gov/vuln/detail/CVE-2023-1389) |
| Cloud Router / IoT | EnGenius EnShare IoT Cloud Gateway  
CVE-2025-34035 | \[Unverified\] Patch available | 🔗 [VulnCheck Advisory – EnShare](https://vulncheck.com/advisories/engenius-enshare-iot-gigabit-cloud-service)  
Details: [NVD CVE-2025-34035](https://nvd.nist.gov/vuln/detail/CVE-2025-34035) |
| Realtek SDK Embedded Devices | Realtek AP-Router SDK (UDPServer/miniigd)  
CVE-2021-35394, CVE-2014-8361 | Patch available from vendor | 🔗 \[Unverified\] [Realtek AP-Router SDK Advisory (PDF)](https://www.realtek.com/images/safe-report/Realtek_APRouter_SDK_Advisory-CVE-2021-35392_35393_35394_35395.pdf)  
Details: [NVD CVE-2021-35394](https://nvd.nist.gov/vuln/detail/CVE-2021-35394)  
(Note: Download firmware released by the router’s OEM manufacturer) |
| Tenda Routers | Tenda Router (AC / AX / F-series)  
CVE-2024-46048, CVE-2024-32314, CVE-2022-35555 | Check by model | 🔗 \[Unverified\] [Tenda Download Center](https://www.tendacn.com/download)  
Details: [NVD CVE-2024-46048](https://nvd.nist.gov/vuln/detail/CVE-2024-46048) |
| Industrial Router | Hytec Inter HWL-2511-SS 3G Router  
CVE-2022-36553 | Patch available | 🔗 \[Unverified\] [Hytec Inter Website](https://www.hytec.co.jp/eng/)  
Details: [NVD CVE-2022-36553](https://nvd.nist.gov/vuln/detail/CVE-2022-36553) |
| D-Link Devices (Unsupported) | D-Link DIR-859, Go-RT-AC750, DNS-320...  
CVE-2024-10914, CVE-2024-10915, CVE-2024-23625, CVE-2022-37055, CVE-2019-17621 | ⚠️ End-of-Life (EoL)  
(No patch available) | 🔗 \[Unverified\] [D-Link SAP10482](https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10482)  
🔗 \[Unverified\] [D-Link SAP10383](https://supportannouncement.us.dlink.com/security/publication.aspx?name=SAP10383)  
Details: [NVD CVE-2024-10915](https://nvd.nist.gov/vuln/detail/CVE-2024-10915)  
**Action:** Replace with a new device or fully isolate from the Internet. |
| Legacy CCTV Cameras / DVRs | AVTECH AVM1203, MVPower, TBK, KGUARD  
CVE-2024-7029, CVE-2016-20016, CVE-2024-3721, CVE-2026-87827 | ⚠️ End-of-Life (EoL)  
(Mostly no patch) | 🔗 [NVD CVE-2024-7029 (AVTECH)](https://nvd.nist.gov/vuln/detail/CVE-2024-7029)  
🔗 [NVD CVE-2016-20016 (MVPower)](https://nvd.nist.gov/vuln/detail/CVE-2016-20016)  
🔗 [NVD CVE-2024-3721 (TBK)](https://nvd.nist.gov/vuln/detail/CVE-2024-3721)  
**Action:** Place behind NAT, disable UPnP, block outbound Internet ports. |

## Step-by-Step Troubleshooting Guide for Users & Administrators

### Step 1: Handle and clean suspected infected equipment (Urgent: 0 - 24 hours)

*   Physical reboot (Hard Reboot): Disconnect the device's power for at least 30 seconds and then plug it back in to clean up malicious processes running in temporary RAM memory (/tmp).
    
*   Check the existence of backdoors on Linux devices with shell access:
    
    *   `find / -name "*cling*" -o -name "`[`wget.sh`](http://wget.sh)`" 2>/dev/null`
        
    *   `grep -rnE "\.cling|/tmp/" /etc/inittab /etc/init.d/ /etc/rc.d/ 2>/dev/null`
        
    *   `grep -E "/proc/[0-9]+" /proc/mounts`
        
*   Remove persistence if detected: If the device has /root/.cling or /usr/local/bin/.cling files, delete these files and edit /etc/inittab, /etc/init.d/rcS files to remove the line calling the backdoor.
    
*   Update the latest firmware immediately from the manufacturer's official link.
    

### Step 2: Lock down the cyber attack surface (Hardening)

*   Turn off the Remote Management feature (Remote Management via WAN): On the router and camera, turn off the feature that allows logging into the admin website from the outside Internet (only allows access via internal LAN).
    
*   Disable UPnP protocol: Turn off the UPnP (Universal Plug and Play) feature on routers and surveillance cameras. This is the main vector exploited by ClingSTUN via CVE-2024-23625 and CVE-2014-8361.
    
*   Change default password: Change all default admin passwords (admin/admin, root/123456) with a complex password over 12 characters.
    

### Step 3: Configure Firewall to block STUN flow from IoT zone

*   Because ClingSTUN is required to send STUN packets out to the Internet to punch the NAT hole, network administrators need to apply a firewall policy:
    
*   Prohibit outbound UDP traffic for ports 3478, 5349 (standard STUN) and 19302 (Google STUN) originating from the IP ranges of surveillance cameras, secondary routers and IoT devices.
    
*   Only open these ports for video conferencing and VoIP systems that have approved identities.
    

### Step 4: Deploy NIDS & YARA monitoring rules for SOC

Rule Suricata detects abnormal STUN Binding Request packet:

![](https://cdn.hashnode.com/uploads/covers/6777abffdb647396c7d71de4/998589e6-2e29-4415-a73c-3b3f817cc3ec.png align="center")

Rule YARA scans and detects ClingSTUN binary files on Linux operating systems:

![](https://cdn.hashnode.com/uploads/covers/6777abffdb647396c7d71de4/3029f694-d82d-404e-952a-a93a0f867180.png align="center")

### Solutions for dealing with End-of-Life (EoL) devices

For old D-Link, AVTECH devices or recorders whose manufacturer has stopped supporting software updates:

1.  Hardware replacement: Plan to phase out and replace with modern devices that are still in the support cycle for regular security updates.
    
2.  Compensating Controls: If it is necessary to maintain EoL equipment due to operational requirements, it is mandatory to:
    
    *   Isolate devices into a separate VLAN (Micro-segmentation).
        
    *   Completely block two-way Internet connections: Do not allow the device to send or receive any packets out to the Internet.
        
    *   Placed behind a Next-Gen Firewall (NGFW) that features Virtual Patching (IPS Signature) to block Command Injection exploit payloads before reaching the device.
        

## References

[Linux Backdoor Abuses STUN Protocol, Exploits Dozens of Flaws - SecurityWeek](https://www.securityweek.com/linux-backdoor-abuses-stun-protocol-exploits-dozens-of-flaws/)

[ClingSTUN Linux Backdoor Abuses Public STUN Infrastructure | FortiGuard Labs](https://www.fortinet.com/blog/threat-research/clingstun-linux-backdoor-abuses-public-stun-infrastructure)

[New Linux malware turns vulnerable IoT devices into proxy nodes | CSO Online](https://www.csoonline.com/article/4231136/new-linux-malware-turns-vulnerable-iot-devices-into-proxy-nodes.html)

[ClingSTUN: 7 Exploits Power a Self-Spreading Backdoor](https://www.obsonis.com/decoded/clingstun/)