FortiGuard Labs just found Linux malware that turns unpatched, internet-exposed devices into attacker-controlled proxies. Here's how it gets in, how it hides, and the operator drill that keeps your gear off its menu.

On October 6, 2026, FortiGuard Labs disclosed a new Linux malware strain called ClingSTUN (reported by Thailand's CERT). It doesn't chase your data, your crypto wallets, or your SSH keys. It wants something simpler: your IP address. Once installed, a compromised box becomes a relay — a disposable proxy the attackers can route their own traffic through. Your router, your NAS, that dusty IoT gateway you forgot in the rack: all of them are potential inventory for someone else's operation.

How it gets in: old bugs, new packaging

ClingSTUN doesn't burn zero-days. According to the researchers, it exploits 24 previously disclosed but unpatched vulnerabilities across products from D-Link, TP-Link, Ivanti, Realtek, Tenda, and AVTECH — the exact brands that dominate home routers, small-business gateways, and cheap embedded gear. The threat actors were observed continuously adding and modifying the exploits they use, so the list is a moving target.

That detail is the whole story. Every one of those 24 bugs had a patch, an advisory, and a CVE number. The victims weren't running exotic software; they were running old software that faced the internet. If you administer anything exposed — a WireGuard endpoint, a VPS, a router with remote management on — this is the part that should make you reach for your update checklist.

What it does once inside

The malware's playbook is disciplined and businesslike:

  • Persistence: it re-establishes itself on boot, so a power cycle won't evict it.
  • Territory: it terminates other malware already running on the system. Your box is an asset; competitors are bad for business.
  • Remote command execution: the attackers keep an open line to run whatever they need.
  • Lateral spread: ClingSTUN carries exploits for seven additional vulnerabilities, scanning for neighboring devices it can infect next.

But the headline feature is right there in the name: STUN. The malware uses the Session Traversal Utilities for NAT protocol to discover its own externally reachable IP address and ports, phoning out to commonly available public STUN servers. That keeps connectivity alive through NAT — and the traffic blends in with legitimate VoIP or WebRTC activity. Your firewall sees a device talking STUN; so does every video call on your network.

The operator drill

The ThaiCERT advisory lays out exactly what to do, and none of it is exotic:

  1. Audit everything internet-exposed. Routers, cameras, NAS boxes, old VPS images. If it has a public IP or a port-forward, it's in scope.
  2. Patch now. Firmware updates, security updates, whatever the vendor ships. Twenty-four known CVEs did the damage here — this was preventable at the patch stage.
  3. Shrink the surface. Disable or restrict services that don't need to be reachable from outside. Remote management on a consumer router is almost never worth the risk.
  4. Retire or isolate end-of-life gear. Devices that can no longer receive security updates don't get to face the internet. Quarantine them or replace them.
  5. Watch for the pattern, not the single signal. Monitor for abnormal processes, unusual UDP connections, and persistent STUN traffic combined with other suspicious behavior. But remember the caveat: legitimate applications use STUN too — STUN traffic alone is not proof of infection.

The uncomfortable truth of ClingSTUN is that it isn't sophisticated. It's industrialized. Twenty-four old bugs, a NAT-traversal trick borrowed from WebRTC, and persistence any sysadmin could write. The defense isn't sophistication either: patch, shrink, watch. Boring works.

Sources