A newly documented Linux backdoor is hijacking unpatched routers, cameras and other internet-facing devices and turning them into proxy nodes that its operators can steer remotely. FortiGuard Labs researcher Vincent Li named the malware ClingSTUN in a report published on October 5, and Peru's National Digital Security Center (CNSD) relayed the findings in its integrated alert 193-2026 the following day.
The malware does not need anything new to get in. Every entry point Fortinet lists is an already-published vulnerability, which means the devices it lands on are the ones nobody has updated.
Two dozen old doors into the same house
Fortinet saw the campaign widen in stages. It began with a single bug, CVE-2022-36553, a command injection flaw in Hytec Inter HWL-2511-SS routers, and that first phase lasted only two days. The operators then moved to new download servers and switched to flaws in EnGenius's IoT cloud service (CVE-2025-34035) and D-Link's UPnP service (CVE-2024-23625), before adding command injection bugs in Linear, Realtek, TP-Link, AVTECH and D-Link devices. By publication Fortinet counted 24 CVEs used for initial access, plus hard-coded exploits for seven more that ClingSTUN uses to spread itself.
Fortinet did not attribute the campaign to any named group, and did not say how many devices have been infected or name any victims.
Hiding in the traffic video calls make
ClingSTUN works as a back-connect proxy. Its distinctive trick is the use of STUN, the protocol voice and video apps use to discover how a device looks from the outside of a home or office network. The malware sends small STUN requests to public STUN servers to learn its external address and port, then keeps that mapping alive with regular check-ins. Because those servers are legitimate public services, the traffic looks much like ordinary VoIP and WebRTC activity.
The backdoor then waits for a 20-byte packet from the operator. One command makes it open an outbound connection to an address in the message and run whatever command it receives. Fortinet is careful to say that how the operator learns the device's external mapping and pushes commands through NAT remains unverified, and warns that the STUN servers themselves should not be treated as attacker infrastructure.
Once installed, ClingSTUN copies itself to hidden files named .cling, adds itself to boot scripts, wipes its own command line so tools like ps show nothing, and, when running as root, disguises itself as the system's init process. It also kills competing malware and stops the device's watchdog timer.
Replace or isolate devices that no longer get updates
Fortinet's advice is basic lifecycle hygiene: keep an inventory of internet-facing devices and their support status, patch promptly with actively exploited flaws first, restrict unnecessary exposed services, and replace or isolate hardware the vendor no longer supports. Defenders should look for unexpected UDP connections and recurring STUN keepalives from devices that have no reason to make calls, while treating STUN alone as a clue rather than proof.
Fortinet's indicators include these download servers and sample hashes:
- 124[.]163[.]212[.]119
- 222[.]223[.]152[.]97
- 118[.]145[.]196[.]225
- SHA-256: dc892f5013edb0aa1e61e808511387373d8d120348b5be0929621d21e6e9946a
- SHA-256: a297eddfa7abea8d411afc0f150f8f6f30e470a77204de87e3b0815fa9bb8a84
Fortinet detects the malware as BASH/Mirai.AEH!tr.dldr, BASH/Dloader.P!tr and Linux/Agent.BHT!tr. Proxy networks built from forgotten home and office hardware are a recurring theme, from streaming boxes renting out home connections to Mirai scanning waves. ClingSTUN is another reminder that a device nobody patches is a device somebody else will eventually use.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.