ClingSTUN Linux Backdoor Abuses Public STUN Infrastructure

    Tuesday, October 6, 2026 In: Threat Research Print

    Date: 10/06/2026

    Severity: High

    Summary

    ClingSTUN is a Linux backdoor that exploits unpatched vulnerabilities in Internet-facing routers and IoT devices to establish persistent access and turn compromised systems into remotely controlled proxy nodes. The campaign exploited multiple vulnerabilities, including CVE-2022-36553, CVE-2025-34035, CVE-2024-23625, CVE-2021-35394, and CVE-2023-1389, across devices from several vendors. ClingSTUN abuses legitimate public STUN infrastructure for NAT traversal and connectivity, helping its traffic blend with normal VoIP/WebRTC communications while supporting remote command execution and persistent proxying. 

    Indicators of Compromise (IOC) List

    IP Address

    124.163.212.119

    222.223.152.97

    118.145.196.225

    Hash

    dc892f5013edb0aa1e61e808511387373d8d120348b5be0929621d21e6e9946a

    a297eddfa7abea8d411afc0f150f8f6f30e470a77204de87e3b0815fa9bb8a84

    4fbd61cb9181ebbc4fe9a6e59d3c346dc00001da48d66bd890556fc6fad22b07

    121f2050e3c891b29565fd73451fff7ae60199c86eb8d79ec1eb1d9844578487

    48f9b72ce72ab7087794650d6eef10135345088384fbde1482f1c74a02b80302

    e6e113783356446aef66e5296db45b244f318292af7cebc2a9bd76f095a95c4c

    c1d8e2829ea63b9dc1cf2c3421a5093406adad4d6622e238376e78e908e0e6e8

    48962b3893f2c8261e32e6b95ea7d463d145a529a8b2a6c987dd979454405c73

    76692a23abe718b93e63edefd743971ec627c0cdf3778f856bd5ec88003deaa2

    ec199c78c11040fd3127887222fd75a85e5797bf96aa691a117fdd83dd663d81

    c0d8ffebfba969b1c1ca76bd9623bb623e9f95155c8ceca77d8fcc521435a497

    f49f45303cbfccee14ff193ac9608f860e6d616f08c0ecbef1ec44f7c863d7ec

    9391c6ad17aced1142607c0c623b18d86a7697cc483d204ffac94093e26b8068

    9391c6ad17aced1142607c0c623b18d86a7697cc483d204ffac94093e26b8068

    e4d12208789f36efc5a1ff765088fed95d6bb5972d1a804a4536fd42366797d4

    284e5ec8748f99fd1b8c331b699a5fe5fd4448bbaae0347a940f427f931c4d14

    6581bf37184bb2db899b9893064d39dd314ea691adf3281cc0aa7e0a31e5138a

    10d83c1748895361e07320f68d44d427b43cadd2cbffe0ab5e607ab03aec83da

    2ed54e0f988a62039abed88f6394eb1e3d5ed931f0183556055417fb08844ecf

    b90640b392827b4f2d280f6cf67860862953331917d42df23e1653a92f2f98ad

    dfba6008a2c828a9cb62342aec53006ae05a60cb8d4c41c3fa216fd727e8c6a3

    5c4e263546fb21f8fe8732789a5b6583eaa8ae11ebeef099462a7c9bf50e022d

    Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection

    Detection Query 1 :

    dstipaddress IN ("222.223.152.97","124.163.212.119","118.145.196.225") or srcipaddress IN ("222.223.152.97","124.163.212.119","118.145.196.225")

    Detection Query 2 :

    sha256hash IN ("48962b3893f2c8261e32e6b95ea7d463d145a529a8b2a6c987dd979454405c73","a297eddfa7abea8d411afc0f150f8f6f30e470a77204de87e3b0815fa9bb8a84","ec199c78c11040fd3127887222fd75a85e5797bf96aa691a117fdd83dd663d81","10d83c1748895361e07320f68d44d427b43cadd2cbffe0ab5e607ab03aec83da","121f2050e3c891b29565fd73451fff7ae60199c86eb8d79ec1eb1d9844578487","dc892f5013edb0aa1e61e808511387373d8d120348b5be0929621d21e6e9946a","5c4e263546fb21f8fe8732789a5b6583eaa8ae11ebeef099462a7c9bf50e022d","2ed54e0f988a62039abed88f6394eb1e3d5ed931f0183556055417fb08844ecf","dfba6008a2c828a9cb62342aec53006ae05a60cb8d4c41c3fa216fd727e8c6a3","4fbd61cb9181ebbc4fe9a6e59d3c346dc00001da48d66bd890556fc6fad22b07","c1d8e2829ea63b9dc1cf2c3421a5093406adad4d6622e238376e78e908e0e6e8","c0d8ffebfba969b1c1ca76bd9623bb623e9f95155c8ceca77d8fcc521435a497","e4d12208789f36efc5a1ff765088fed95d6bb5972d1a804a4536fd42366797d4","6581bf37184bb2db899b9893064d39dd314ea691adf3281cc0aa7e0a31e5138a","284e5ec8748f99fd1b8c331b699a5fe5fd4448bbaae0347a940f427f931c4d14","48f9b72ce72ab7087794650d6eef10135345088384fbde1482f1c74a02b80302","e6e113783356446aef66e5296db45b244f318292af7cebc2a9bd76f095a95c4c","f49f45303cbfccee14ff193ac9608f860e6d616f08c0ecbef1ec44f7c863d7ec","b90640b392827b4f2d280f6cf67860862953331917d42df23e1653a92f2f98ad","9391c6ad17aced1142607c0c623b18d86a7697cc483d204ffac94093e26b8068","76692a23abe718b93e63edefd743971ec627c0cdf3778f856bd5ec88003deaa2")

    Reference:    

    https://www.fortinet.com/blog/threat-research/clingstun-linux-backdoor-abuses-public-stun-infrastructure                                                       


    Tags

    MalwareVulnerabilityBackdoorExploitCVE-2022CVE-2025CVE-2026CVE-2024CVE-2021CVE-2023

    « Previous ArticleNext Article »

    Comments

    No records to display

    Looking for Something?
    Threat Research Categories:
    Tags

    Privacy & Security StatementTerms & Conditions
    Copyright © 2026 by Gurucul - All rights reserved.