Executive Summary
In October 2026, FortiGuard Labs discovered ClingSTUN, a sophisticated Linux malware strain targeting Internet of Things (IoT) devices through 24 known vulnerabilities spanning from 2014 to 2026. The malware exploits devices from manufacturers including D-Link, Realtek, Ivanti, and TP-Link, transforming compromised systems into proxy nodes for malicious traffic routing. What distinguishes ClingSTUN is its innovative use of legitimate public STUN servers to obscure command-and-control communications, making malicious activity appear as normal VoIP and WebRTC traffic while establishing persistent access to enterprise networks.
This incident highlights the growing weaponization of IoT infrastructure as threat actors increasingly leverage unpatched devices for proxy operations and network persistence. The malware's multi-architecture exploit chain and living-off-the-land techniques represent an evolution in IoT-targeted campaigns, emphasizing the urgent need for comprehensive IoT security frameworks as organizations face mounting pressure to secure their expanding attack surfaces.
Why This Matters Now
ClingSTUN demonstrates how unpatched IoT devices are becoming critical infrastructure for cybercriminal proxy operations, with attackers now capable of blending malicious traffic into legitimate network protocols to evade detection at scale.
Attack Path Analysis
ClingSTUN malware exploits 24 known IoT vulnerabilities to gain initial access, then establishes persistence and uses legitimate STUN servers for covert command and control communications. The malware spreads laterally to other vulnerable IoT devices using hard-coded exploits, creates proxy nodes for routing malicious traffic through enterprise networks, and potentially enables data exfiltration or further attacks while evading detection by blending with legitimate network traffic.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
Attackers scan for and exploit 24 known vulnerabilities in IoT devices including routers, surveillance systems, and industrial equipment from manufacturers like D-Link, Realtek, Ivanti, and TP-Link to gain initial access
Related CVEs
CVE-2021-36380
CVSS 9.8A command injection vulnerability in Sunhillo SureLine surveillance data distribution software allows remote attackers to execute arbitrary commands.
Affected Products:
Sunhillo SureLine – < 3.2.1
Exploit Status:
exploited in the wildCVE-2014-8361
CVSS 9.8A remote code execution vulnerability in Realtek SDK affects multiple router and IoT devices allowing unauthenticated attackers to execute arbitrary commands.
Affected Products:
Realtek SDK – < 2.0
Exploit Status:
exploited in the wild
MITRE ATT&CK® Techniques
Exploit Public-Facing Application
Exploitation for Privilege Escalation
Create or Modify System Process: Systemd Service
Proxy
Protocol Tunneling
Masquerade Task or Service
Exploitation of Remote Services
Remote System Discovery
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – External vulnerability scans
Control ID: 11.3.1
NYDFS 23 NYCRR 500 – Penetration testing and vulnerability assessments
Control ID: 500.05
DORA – Identification
Control ID: Article 8
CISA ZTMM 2.0 – Device inventory and asset management
Control ID: 2.3.1
NIS2 Directive – Risk analysis and information system security policies
Control ID: Article 21(2)(a)
NIST SP 800-53 – Flaw Remediation
Control ID: SI-2
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Utilities
Critical infrastructure vulnerability to ClingSTUN malware targeting industrial IoT systems, enabling lateral movement and compromising SCADA operations through unpatched devices.
Airlines/Aviation
Aviation surveillance systems exposed via CVE-2021-36380 in FAA-used Sunhillo equipment, creating proxy nodes that compromise air traffic control network integrity.
Telecommunications
Network equipment and routers vulnerable to 24 CVEs exploited by ClingSTUN, enabling attackers to establish persistent backdoors in telecommunications infrastructure.
Manufacturing
Industrial automation systems at risk from IoT device compromise, allowing threat actors to pivot into OT networks and disrupt production operations.
Sources
- ClingSTUN Turns Vulnerable IoT Devices Into Proxy Nodeshttps://www.darkreading.com/iot/clingstun-vulnerable-iot-devices-proxy-nodesVerified
- Fortinet FortiGuard Labs ClingSTUN Malware Analysishttps://www.fortinet.com/blog/threat-research/clingstun-malware-analysisVerified
- CISA Known Exploited Vulnerabilities Cataloghttps://www.cisa.gov/known-exploited-vulnerabilities-catalogVerified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF would constrain ClingSTUN's lateral spread across IoT devices through network segmentation and east-west traffic controls. The fabric's identity-aware routing and egress enforcement would likely reduce the malware's ability to establish widespread proxy networks and covert communications.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Initial device compromise would likely still occur, but the fabric's microsegmentation policies would constrain the malware's ability to discover and communicate with other network segments beyond the compromised device's immediate zone.
Control: Zero Trust Segmentation
Mitigation: While device-level privilege escalation may succeed, zero trust segmentation would likely constrain the malware's elevated privileges to the compromised device's isolated network segment, preventing privileged access to adjacent systems or network resources.
Control: East-West Traffic Security
Mitigation: Lateral movement attempts would likely be constrained by east-west traffic inspection and policy enforcement, reducing the malware's ability to reach and exploit vulnerable devices across different network segments or security zones.
Control: Multicloud Visibility & Control
Mitigation: STUN server communications would likely be subject to visibility and policy controls, potentially constraining the malware's ability to establish reliable command channels and reducing its operational effectiveness across multiple cloud environments.
Control: Egress Security & Policy Enforcement
Mitigation: Egress policy enforcement would likely constrain the malware's ability to establish effective proxy networks by limiting outbound traffic patterns and destinations from compromised IoT devices, reducing data exfiltration capabilities and traffic routing effectiveness.
Despite containment measures, organizations would likely still experience some operational impact from compromised devices within isolated segments, though the scope of internal network access and reputational damage would be significantly reduced.
Impact at a Glance
Affected Business Functions
- Network Infrastructure Management
- Industrial Control Systems
- Surveillance and Monitoring
- Internet Gateway Services
Estimated downtime: 7 days
Estimated loss: $500,000
Compromised IoT devices can expose internal network topology, surveillance footage, operational technology data, and serve as proxy infrastructure for malicious activities leading to IP blocklisting and reputational damage
Recommended Actions
Key Takeaways & Next Steps
- • Implement Zero Trust Segmentation to isolate IoT devices from critical network segments and prevent lateral movement between compromised devices
- • Deploy Egress Security & Policy Enforcement to detect and block unauthorized outbound communications from IoT devices to STUN servers and other external destinations
- • Enable Multicloud Visibility & Control to monitor anomalous interactions, repeated malformed requests, and suspicious automation patterns from IoT devices
- • Establish East-West Traffic Security controls to inspect and control workload-to-workload communications and detect lateral movement attempts between IoT systems
- • Deploy Threat Detection & Anomaly Response capabilities to baseline normal IoT device behavior and alert on deviations such as unexpected STUN communications and proxy traffic patterns
