Threat actors are exploiting a critical remote code execution (RCE) vulnerability in the Realtek Jungle SDK (CVE-2021-35394) to deploy a sophisticated botnet malware known as Cling (or ClingSTUN). The malware is notable for its abuse of standard Session Traversal Utilities for NAT (STUN) protocol behavior to create a command-and-control (C2) channel. By disguising its traffic as legitimate NAT-traversal activity, Cling can bypass traditional network monitoring and even make operator commands appear as if they originate from trusted public services like Google's STUN servers.
Cling achieves persistence on infected systems by either modifying initialization scripts (SysV and BusyBox) or by hijacking the 'wget' binary. It targets a wide range of IoT devices, including routers and DVRs from vendors such as Realtek, D-Link, Linksys, and TP-Link, using a comprehensive library of embedded exploits. Once established, the botnet can be used for recursive propagation, proxying, TCP tunneling, and launching distributed denial-of-service (DDoS) attacks against various targets, including ISPs and gaming servers.
Top comments (0)