Fortinet's FortiGuard Labs has detailed a new Linux backdoor, dubbed ClingSTUN, which leverages legitimate public Session Traversal Utilities for NAT (STUN) infrastructure to mask its command and control (C2) communications. The malware primarily targets unpatched Internet of Things (IoT) devices, functioning as a back-connect proxy that turns compromised systems into remotely controlled nodes.
ClingSTUN's distinctive approach involves sending standard STUN binding requests to public STUN servers. This allows the malware to discover the external IP addresses and ports of infected devices, maintain NAT bindings, and improve connectivity for its operators. This traffic blends seamlessly with legitimate VoIP and WebRTC communications, making it difficult for network defenders to distinguish malicious activity from normal application usage.
The campaign initially exploited a known command injection vulnerability in Hytec Inter routers. Over time, the attackers expanded their targeting to include devices from a dozen additional vendors, such as D-Link, TP-Link, Realtek, and Linksys, along with various DVR and IoT cloud platforms. Many of these devices are susceptible due to infrequent updates and limited monitoring.
Upon successful exploitation, a small downloader script installs the appropriate ClingSTUN variant for the device's architecture, supporting ARM, MIPS, PowerPC, and Intel. Later versions of the malware also include a mechanism to scan for and eliminate competing malware by checking mounted filesystems and terminating suspicious processes running from temporary directories.
ClingSTUN establishes persistence by copying itself to two separate locations and appending itself to three different boot scripts, ensuring survival across reboots. It also employs a process integrity check, comparing running processes against their claimed command lines and terminating any discrepancies, a tactic that further eliminates rival malware.
Two notable features of ClingSTUN demonstrate sophisticated design. First, it disables the device's watchdog timer, preventing automatic reboots that could disrupt the infection. Second, when running with root privileges, it manipulates its process metadata to impersonate PID 1, the initial process started by the kernel. This makes the malware appear as the init system in basic process listings. After achieving persistence, ClingSTUN clears its original command-line arguments, making its command line appear empty in tools like `ps`. If running as root, it copies selected process information files from `/proc/1/` to `/tmp` and then bind-mounts `/tmp` over its own `/proc/` directory, effectively hiding its true process information behind that of PID 1.
For command delivery, ClingSTUN establishes a UDP socket, binds to a random local port, and sends 20-byte STUN binding requests to public endpoints. Initial versions targeted 24 endpoints, requiring at least half to succeed. Later iterations reduced this to 13 endpoints, demanding successful connections to all of them, indicating an effort to improve reliability. A single control datagram can trigger ClingSTUN to open an outbound TCP connection to an operator-specified address, download a command, and execute it, thereby offloading heavy data transfer from the STUN channel.
The malware also incorporates hardcoded exploits for seven additional vulnerabilities, enabling it to spread further by turning each infected device into a scanner for new targets. Fortinet emphasizes that the public STUN servers themselves are not compromised or malicious; they are simply being used as intended by the attackers.
Fortinet's report underscores the critical importance of robust cyber hygiene, including maintaining an inventory of internet-facing devices, tracking firmware and support status, and promptly applying security updates, especially for vulnerabilities known to be actively exploited.
