ClingSTUN: The Linux Backdoor That Hides in Your Own NAT Traversal Traffic

A Linux backdoor documented this week does something quietly clever: it borrows the STUN protocol, the very tool your edge devices use to punch through NAT, and turns it into a command channel that never needs an attacker-controlled server.

FortiGuard Labs published the details of the malware, dubbed ClingSTUN, on Monday. SecurityWeek covered it the same day. It is a back-connect proxy backdoor for Linux, and it is aimed at exactly the kind of hardware that fills African enterprise networks: the routers, the CCTV NVRs, the little industrial gateways that nobody patches and almost nobody monitors.

What ClingSTUN actually does

The initial access list reads like a catalogue of hardware shipped into this continent in bulk. FortiGuard’s researchers counted two dozen exploited flaws across Avtech, EnGenius, D-Link, Hytec, Ivanti, Lantronix, Linear, MeiG, Realtek, Sunhillo, Tenda and TP-Link devices, and the operators appear to be adding more exploits over time. A self-propagation module carries hardcoded exploits for seven additional vulnerabilities in China Mobile, KGUARD, Linksys, LB-LINK, MVPower, Realtek and TBK gear.

Once inside, the malware copies itself into two hidden files with executable permissions and appends startup commands to three system initialisation scripts. It survives reboot. It also kills processes belonging to competing botnets and terminates the watchdog timer that would otherwise restart a hung device. This is not a script kiddie’s toy; it clears turf.

The downloaders pull binaries for AMD x86-64, ARM, Intel 80386, MIPS R3000 and PowerPC. If your branch office runs a ten-year-old MIPS router, ClingSTUN has a build with its name on it.

The STUN trick

Here is the part that should worry you most. ClingSTUN opens a UDP socket on a random local port and sends ordinary STUN binding requests to public STUN servers, the same ones VoIP phones and consumer routers query to discover their external address and port mapping. Then it periodically sends its group identifier and list of mapped ports to those same STUN endpoints.

There is no separate coordination server in this path. The operators query legitimate third-party infrastructure to find their infected boxes, and the traffic looks like any NAT traversal noise on the wire. FortiGuard makes a point of this: public STUN servers should not be automatically classified as attacker-controlled infrastructure. Defenders should instead correlate STUN activity with suspicious process behaviour, unexpected UDP connections and recurring keepalive traffic.

Specific crafted packets let the operators execute remote code and trigger the self-propagation routine. The whole design is built around blending in.

Why this matters for African enterprises

Three things make ClingSTUN a local problem, not a foreign one.

• The exploited brands are the brands we deploy. Tenda, TP-Link, D-Link, Avtech and MeiG gear moves in volume through African distribution channels because it is cheap and available. Many units ship with firmware that will never see another update.
• Edge devices sit inside the trust boundary. A compromised router between your POS terminal and your payment gateway sees everything that traverses it, and no EDR agent will ever inspect its firmware.
• Detection rules assume command-and-control looks wrong. ClingSTUN’s traffic looks right. STUN is supposed to be there. Nobody alerts on a router asking a public STUN server what its public IP is.

What to do about it

Inventory matters more than opinions here. If you cannot list every internet-connected device on your network by model and firmware version, you are running a fleet you do not control. From there:

1. Identify devices from the affected vendor list and check whether their firmware is still supported. If the vendor has gone quiet, the device is a liability, not an asset.
2. Baseline UDP traffic leaving edge devices. Recurring outbound UDP to public STUN servers from a device running no VoIP is exactly the anomaly to chase.
3. Watch for the persistence fingerprints: hidden executable files in unusual paths, new lines appended to initialisation scripts.
4. Stop treating the edge as scenery. Every bridge, gateway and NVR is a network hop with root access to your traffic.

The eHawu view

ClingSTUN shows that the perimeter fight has moved to hardware nobody watches, and chasing this class of threat with patch memos alone fails on devices where a patch will never come. eHawu works at the network layer: continuous visibility into every device that touches your traffic, behavioural baselines that flag an unmanaged router suddenly talking to the wrong endpoints, and enforcement that stops a poisoned gateway from pivoting deeper into your stack. When the malware hides inside legitimate protocol noise, the only defence with a chance is knowing, at all times, what your network should look like when nothing is wrong.