Threat Intelligence Report

ClingSTUN Linux Backdoor Abuses Public STUN Infrastructure

📅 October 8, 2026 📰 www.fortinet.com 🔍 31 CVE(s) referenced

ClingSTUN exploits unpatched IoT devices to create persistent Linux proxy backdoors, blending STUN-assisted NAT traversal with legitimate traffic while enabling stealthy remote control and self-propagation.

vendor

CVE-2022-37055, CVE-2023-26801, CVE-2023-41011, CVE-2023-46805, CVE-2014-8361, CVE-2024-10914, CVE-2024-32314, CVE-2025-34035, CVE-2024-7029, CVE-2024-35340, CVE-2019-7256, CVE-2024-10915, CVE-2024-3721, CVE-2025-67038, CVE-2022-35555, CVE-2026-36356, CVE-2024-32281, CVE-2022-26289, CVE-2021-35394, CVE-2021-36380, CVE-2022-36553, CVE-2024-32292, CVE-2026-87827, CVE-2024-23624, CVE-2024-23625, CVE-2024-46048, CVE-2025-34037, CVE-2019-17621, CVE-2024-21887, CVE-2023-1389, CVE-2016-20016

🔐 Sign In to Read Full Report

You'll need to accept our Terms of Service to access the platform.

📊 Visual Mindmap

🎯 IOC Extraction

⚔️ MITRE ATT&CK TTPs

📦 STIX 2.1 Bundle