A newly observed IoT botnet named Cling exploits vulnerable internet-facing devices and disguises its command-and-control communications as legitimate STUN traffic, including packets that appear to originate from Google’s public STUN infrastructure.
The technique lets operators hide malicious instructions amid common NAT-traversal traffic used by collaboration platforms, browsers, and real-time communication applications.
Nozomi Networks Labs identified the activity while tracking exploitation attempts against CVE-2021-35394, a critical remote code execution flaw affecting the Realtek Jungle SDK diagnostic component commonly compiled as UDPServer.
Cling IoT Malware Masquerades as Google STUN Traffic
The vulnerability affects SDK versions from 2.0 through 3.4.14B and enables unauthenticated remote attackers to execute arbitrary commands on exposed devices.
The flaw remains particularly attractive to botnet operators because Realtek SDK components are embedded in routers, access points, repeaters, cameras, DVRs, and other IoT appliances that often remain unpatched for years.
In observed Cling infections, attackers sent specially crafted UDP datagrams beginning with orf;, followed by shell commands that used BusyBox wget to retrieve, mark executable, and launch the malware.
Cling expands beyond its initial foothold by embedding exploit routines for several known command-injection vulnerabilities affecting Realtek devices, LB-LINK routers, TBK DVRs, Linksys products, Eir routers, FiberHome hardware, and MVPower CCTV DVRs.
This allows compromised systems to scan for additional vulnerable internet-connected devices and deploy the malware to newly discovered targets.
The malware establishes persistence by copying itself to /root/.cling and /usr/local/bin/.cling, then adding execution entries to SysV and BusyBox initialization files including /etc/inittab, /etc/init.d/rcS, and /etc/rc.d/rc.boot.
It also hijacks wget by moving the legitimate binary to wget.r, recording its location in wget.p, and replacing the original executable with its own binary. Whenever wget is subsequently invoked, Cling relaunches itself before passing arguments to the original utility.
Its most notable capability is its STUN-based C2 design. Rather than using a conventional hardcoded domain or suspicious VPS endpoint, Cling sends repeated STUN Binding Requests to 13 public STUN servers approximately every five seconds.
The malware uses an all-zero transaction ID, which violates RFC 8489 expectations that identifiers be random. It then records the public-facing ports returned by the STUN responses and sends custom registration data to the listed servers.
Nozomi Networks found that one server, 145.249.115[.]184:3478, appeared to be colluding with the operators. Controlled registration testing showed that ports advertised only to that server later received commands from Cling C2 infrastructure.
Operator commands are encoded in the 12-byte STUN transaction ID field and can instruct bots to download payloads, scan and exploit devices, establish TCP tunnels, relay proxy traffic, or conduct denial-of-service attacks.
Some command packets appeared to originate from 74.125.250[.]129, associated with stun.l.google.com, likely through UDP source-address spoofing rather than legitimate Google infrastructure.
Defenders should prioritize patching or isolating exposed devices affected by CVE-2021-35394, monitor for repeated STUN requests with zeroed transaction IDs, and hunt for .cling, wget.r, and wget.p artifacts on embedded Linux systems.
| IOC Type | Indicator | Description |
|---|---|---|
| SHA-1 hash | 3b0ac6aaabb3bf8058ca14f9c8ccc613cfa3ea71 | Cling malware sample targeting MIPS-based devices |
| SHA-1 hash | 08636d09d9ffd1713bd6bcb965ad40b6ce3de1aa | Related Cling malware sample targeting MIPS-based devices |
| Loader URL | hxxp://118.45.196[.]225:800/mipsel | Loader host serving a MIPSEL payload |
| Loader URL | hxxp://120.193.219[.]210:800/mipsel | Loader host serving a MIPSEL payload |
| Loader URL | hxxp://58.211.144[.]243:800/mipsel | Loader host serving a MIPSEL payload |
| IP address | 145.249.115[.]184 | STUN server identified as a suspected colluding server in Cling’s registration and command-delivery workflow |
| File path | /usr/local/bin/.cling | Cling executable copy used for persistence |
| File path | /root/.cling | Cling executable copy used for persistence |
| File path | /usr/bin/wget.r | Relocated legitimate wget binary after malware replacement |
| File path | /usr/bin/wget.p | File storing the path to the relocated legitimate wget binary |
| File path | /bin/wget.r | Relocated legitimate wget binary after malware replacement |
| File path | /bin/wget.p | File storing the path to the relocated legitimate wget binary |
| File path | /usr/local/bin/wget.r | Relocated legitimate wget binary after malware replacement |
| File path | /usr/local/bin/wget.p | File storing the path to the relocated legitimate wget binary |
| File path | /sbin/wget.r | Relocated legitimate wget binary after malware replacement |
| File path | /sbin/wget.p | File storing the path to the relocated legitimate wget binary |
| File path | /usr/sbin/wget.r | Relocated legitimate wget binary after malware replacement |
| File path | /usr/sbin/wget.p | File storing the path to the relocated legitimate wget binary |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team
