Cling Botnet Exploits Realtek SDK to Hide in Plain Sight Using STUN Protocol
In October 2026, threat actors exploited CVE-2021-35394, a critical remote code execution vulnerability in Realtek Jungle SDK, to deploy the Cling botnet malware. The malware demonstrated sophisticated command-and-control capabilities by masquerading malicious traffic as legitimate STUN protocol communications, making it appear as routine NAT-traversal activity. Cling infected routers, DVRs, and IoT devices across multiple vendors, establishing persistence through various mechanisms and enabling operators to conduct denial-of-service attacks, proxy operations, and lateral movement. The botnet's innovative use of public STUN infrastructure, including Google's STUN servers, allowed operators to blend malicious communications with legitimate VoIP and WebRTC traffic, significantly complicating detection efforts. This incident highlights the evolving sophistication of IoT botnets and their ability to exploit legitimate network protocols for covert operations, representing a significant shift in how threat actors conduct command-and-control communications in 2026.
Kill Chain
