Linux‑Based ClingSTUN Turns Insecure IoT Gadgets Into Stealth Proxy Relays

Security researchers have uncovered a new Linux backdoor, dubbed ClingSTUN, that hijacks vulnerable Internet‑of‑Things devices and repurposes them as proxy nodes. By routing traffic through compromised hardware, the malware can blend malicious communications with ordinary network flows, making detection more difficult.

ClingSTUN exploits a catalog of 24 documented vulnerabilities commonly found in low‑cost IoT firmware. Once a device is compromised, the malware obtains elevated privileges, installs a lightweight daemon, and begins forwarding traffic that originates from elsewhere on the internet.

The tool’s most notable feature is its reliance on public Session Traversal Utilities for NAT (STUN) servers. STUN is a legitimate protocol used to discover public IP addresses and assist in peer‑to‑peer connections. By piggybacking on these widely trusted servers, ClingSTUN masks its command‑and‑control traffic, making network logs appear normal and sidestepping many traditional security alerts.

Transforming IoT appliances into a distributed proxy network gives attackers a versatile platform for a range of illicit activities, from amplifying denial‑of‑service attacks to exfiltrating data. Because many IoT devices run outdated Linux kernels and lack regular patch cycles, they present an attractive target for automated exploitation.

The discovery follows a pattern of increasingly sophisticated IoT botnets, such as the Mirai family, which previously relied on hard‑coded command servers. ClingSTUN’s use of legitimate infrastructure marks a shift toward stealthier operations that blend into everyday internet traffic, raising the bar for defenders.

Mitigation efforts focus on patching the known flaws that the backdoor leverages, disabling unnecessary services, and employing network‑level monitoring to spot anomalous outbound connections to public STUN endpoints. Vendors are also urged to adopt secure development practices and provide timely firmware updates.

Analysts warn that the tactics demonstrated by ClingSTUN could become a template for future malware, prompting calls for industry‑wide standards on IoT security hygiene and greater scrutiny of traffic to public protocol services. Continued research and coordinated response will be essential to curb the emerging threat landscape.