Threat actors are exploiting a critical remote code execution vulnerability in the Realtek Jungle SDK (CVE-2021-35394) to deploy a sophisticated botnet malware known as Cling, also referred to as ClingSTUN. The malware targets a wide range of internet-facing devices, including routers and DVRs from vendors such as Linksys, Tenda, and D-Link, by leveraging numerous known vulnerabilities to achieve initial access and self-propagation.
Cling's most distinctive feature is its abuse of the Session Traversal Utilities for NAT (STUN) protocol and public STUN infrastructure for command-and-control communications. By masquerading its malicious traffic as legitimate NAT-traversal activity used in VoIP and WebRTC, the botnet effectively evades network monitoring. Once established, the malware achieves persistence by hijacking system init files or the wget binary, allowing it to perform DDoS attacks, set up proxies, and create encrypted tunnels.
Top comments (0)