ClingSTUN infects vulnerable routers, cameras and other IoT devices, turning them into remotely controlled proxy nodes. GajIPS detects infection, C2 activity and propagation attempts
Severity: HIGH · Priority: P2 — IoT botnet infection spreading via unpatched Realtek SDK devices, investigate on hit
These rules provide comprehensive detection for ClingSTUN (also tracked as Cling), a Linux back-connect proxy backdoor. ClingSTUN turns compromised IoT devices — routers, DVRs, IP cameras, access points, and UPnP-enabled appliances — into remotely controlled proxy nodes, and spreads by exploiting unpatched vulnerabilities in internet-facing devices including the Realtek Jungle SDK flaw CVE-2021-35394 (CVSS 9.8), a critical command injection bug that remains unpatched in tens of thousands of devices years after disclosure.
ClingSTUN's defining technical feature is using the STUN protocol — a standard mechanism for voice-over-IP and WebRTC applications to discover their external IP addresses through NAT — as a covert C2 channel. Rather than contacting a dedicated malware command server, ClingSTUN sends 20-byte STUN Binding Requests to 13 public STUN servers (including Google's) roughly every five seconds. These look like ordinary VoIP infrastructure traffic from the outside. The single detection anomaly: ClingSTUN uses all-zero Transaction IDs instead of the random values RFC 5389 requires. One server in that list (145.249.115.184:3478) is operator-controlled — devices advertise their externally mapped ports to it and later receive C2 commands in return. The STUN response rules detect when a ClingSTUN-infected device receives a response with the matching all-zero Transaction ID from this C2 path.
A hit on the inbound CVE-2021-35394 rule indicates an internet-facing Realtek SDK device is being actively attacked. A hit on the outbound CVE-2021-35394 rule indicates a device inside your network is already infected and propagating. A hit on the STUN heartbeat or C2 IP rules indicates an infected device on your network is checking in with the botnet operator. In all cases: identify and isolate the affected device; patch or replace it (the Realtek SDK CVE-2021-35394 fix is available for updated firmware, but many affected devices have no vendor-provided update path, making replacement the safest option); and search for ClingSTUN persistence artifacts on the device filesystem: .cling, wget.r, wget.p, and entries in /etc/init.d/, /etc/rc.local, and similar init scripts.