Cling Malware Masquerades as Google STUN Traffic to Control Compromised IoT Devices

Cling malware is turning compromised internet-connected devices into a botnet while disguising its control traffic as replies from Google’s public STUN service.

The technique makes attacker instructions look like routine communications used by applications to connect across network boundaries.

The infection begins with attacks against exposed devices running vulnerable Realtek software. Earlier reporting on Realtek SDK exploitation attacks documented the same entry point, showing how old flaws continue to give attackers access to routers, access points, repeaters, and other appliances.

Researchers from Nozomi Networks identified Cling while examining a spike in exploitation attempts against CVE-2021-35394.

Nozomi Networks said in a report shared with Cyber Security News (CSN) that the malware uses legitimate-looking STUN exchanges to register infected devices and receive operator commands.

Published on October 1, 2026, the analysis describes a botnet capable of spreading, relaying traffic, opening tunnels, and launching denial-of-service attacks.

Researchers observed attack instructions targeting an internet provider, university infrastructure, and gaming services, but did not report a total infection count or confirmed outages.

Cling Malware Masquerades as Google STUN Traffic

STUN helps a device discover its public address and the network port assigned by its router. Video meetings and browser communications commonly use it, creating background traffic that attackers can imitate without immediately attracting attention from security teams.

Cling contacts 13 hardcoded STUN servers roughly every five seconds. It gathers the ports returned by those services, then sends a separate registration message containing the mapped ports and a tag identifying how the device was infected.

Those registration messages are not valid STUN traffic, and normal servers ignored them during testing. However, one server returned an unusual response that did not correctly echo a request identifier, prompting researchers to investigate its relationship with the botnet.

The team advertised different port sets to each server while pretending to register an infected device. Several hours later, commands arrived at ports disclosed only to the suspicious server, demonstrating that its registration traffic was reaching the operator.

Commands occupy the protocol’s 12-byte transaction identifier, a field normally used to match requests with replies.

This camouflage recalls browser-based malware command channels that similarly exploit familiar communication patterns, although Cling operates through UDP rather than a hijacked browser.

The command packets appeared to originate from Google’s STUN infrastructure. Researchers assessed source-address spoofing as the most likely explanation, supported by differences in packet lifetime values.

They did not establish that Google’s servers were compromised or actually sending the instructions. The distinction matters for investigations: most listed STUN endpoints are legitimate public services, not confirmed attacker infrastructure. Their presence in traffic should be assessed alongside protocol anomalies and device behavior.

Persistence and Defense

Initial exploitation allows attackers to issue shell commands that download and execute the malware. The analyzed sample also contains exploits for CVE-2014-8361, CVE-2023-26801, CVE-2024-3721, CVE-2025-34037, CVE-2016-10372, CVE-2023-41011, and CVE-2016-20016, extending its reach across routers and video-recording equipment.

After infection, Cling creates hidden copies and adds startup entries to survive reboots. It also replaces a standard download utility while preserving access to the original program, allowing ordinary maintenance tasks or later downloads to trigger the malware again.

Its operators can download additional payloads, start or stop scanning, establish TCP tunnels, enable proxy relays, and order flooding attacks. Comparable PolarEdge IoT proxy operations illustrate why compromised edge devices can become infrastructure for abuse beyond the original intrusion.

The analysis examined a MIPS sample, with supporting observations from related files. Its persistence and command features should be treated as findings about the examined sample, not every variant.

Nozomi recommends reviewing exposed appliances, patching the exploited vulnerabilities, and restricting inbound access where updates are unavailable.

Network segmentation can reduce exposure, while investigators should inspect startup changes and replaced download utilities for the artifacts listed below.

Defenders should also investigate frequent STUN requests with all-zero transaction identifiers, unexpected UDP registration messages, and connections that depart from a device’s normal behavior. Trusted server reputation alone cannot establish safety when attackers can forge the apparent source of command traffic.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC

The post Cling Malware Masquerades as Google STUN Traffic to Control Compromised IoT Devices appeared first on Cyber Security News.