New Linux Backdoor ClingSTUN Exploits 24 IoT Flaws to Turn Devices Into Proxy Nodes

The cybersecurity community has identified a new Linux‑based backdoor, dubbed ClingSTUN, that leverages a set of 24 previously disclosed Internet‑of‑Things (IoT) flaws to gain unauthorized access to networked devices. By chaining together these vulnerabilities, attackers can install the malicious payload on a wide range of embedded systems, from smart cameras to industrial controllers, and then use the compromised hardware as a foothold for further operations.

Once installed, ClingSTUN establishes a persistent command channel that allows threat actors to execute arbitrary Linux commands remotely. In addition to direct control, the malware reconfigures the victim device to act as a proxy relay, routing traffic for other compromised nodes and obscuring the true origin of subsequent attacks. The proxy functionality also enables the creation of a decentralized botnet that can be rented out for illicit activities such as credential harvesting or distributed denial‑of‑service campaigns.

The 24 exploited weaknesses span common issues such as default credentials, outdated firmware, and insecure network services—vulnerabilities that have been repeatedly highlighted in industry advisories. IoT manufacturers often prioritize rapid time‑to‑market over rigorous security testing, leaving a large attack surface for opportunistic hackers. ClingSTUN follows a pattern seen in earlier threats like Mirai and Hajime, which similarly turned poorly protected devices into large‑scale botnets.

The emergence of ClingSTUN raises concerns for both consumers and enterprises that rely on connected devices for daily operations. Because the backdoor runs on Linux, it can be deployed on a broad spectrum of hardware architectures without requiring extensive modification. Security analysts warn that the proxy capability could make detection more difficult, as malicious traffic may appear to originate from legitimate IoT endpoints rather than a centralized command server.

Researchers and vendor groups are urging immediate firmware updates and the enforcement of strong, unique passwords on all internet‑exposed equipment. Network administrators are advised to segment IoT devices from critical infrastructure and monitor outbound traffic for anomalous proxy patterns. While the full extent of ClingSTUN’s infection rate remains unknown, the discovery underscores the ongoing need for coordinated patch management and deeper scrutiny of the software supply chain in the rapidly expanding IoT ecosystem.