Researchers have uncovered a new Linux malware strain that exploits a growing list of known vulnerabilities in Internet of Things (IoT) devices to maintain a persistent foothold on enterprise networks.
What makes the malware especially noteworthy is its use of legitimate public STUN servers to help maintain connectivity with compromised devices, allowing the attackers to obscure their infrastructure in otherwise legitimate Internet traffic. STUN is a protocol that helps devices behind firewalls and NAT connect with each other over the Internet.
Malware Targets a Growing List of IoT Vulnerabilities
Fortinet’s FortiGuard Labs researchers identified the malware, which they have dubbed "ClingSTUN," after tracking attacks targeting at least 24 known vulnerabilities in IoT devices. The vulnerabilities affect a wide range of Internet-connected devices including routers, network equipment, surveillance systems, and industrial systems from manufacturers such as D-Link, Realtek, Ivanti, and TP-Link.
The oldest of the set is a long-patched command injection vulnerability from 2021 (CVE-2021-36380) in Sunhillo SureLine surveillance data distribution software used by the FAA and other aviation authorities. The most recent is a command injection flaw from earlier this year (CVE-2026-36356) that affects MeiG Smart FORGE_SLT711 devices.
FortiGuard analyst Vincent Li said threat actors were deploying ClingSTUN in multiple attack waves using a rapidly expanding list of vulnerabilities to gain access to exposed devices. In the attacks FortiGuard observed, the malware used legitimate public STUN servers as a kind of network middleman to figure out how the infected device appeared on the Internet and which ports were reachable from outside, Li wrote.
Leveraging Legitimate STUN Servers
ClingSTUN periodically sent that information back to the STUN servers. FortiGuard did not find a traditional command-and-control server involved in this process and has not determined exactly how the attackers use the connection information to communicate with infected devices. "No separate coordination-server registration was identified in this path, and how the operator obtains the external mapping and delivers control traffic through NAT remains unverified," Li said.
Once installed, ClingSTUN establishes persistence on the compromised system. In addition to its persistence mechanism the malware also includes hard-coded exploits for seven additional vulnerabilities that it can use to spread from an infected device to other vulnerable IoT systems.