Cling Malware Masquerades as Google STUN Traffic to Control Compromised IoT Devices

Cling malware is turning compromised internet-connected devices into a botnet while disguising its control traffic as replies from Google’s public STUN service. The technique makes attacker instructions look like routine communications used by applications to connect across network boundaries. The infection begins with attacks against exposed devices running vulnerable Realtek software. Earlier reporting on Realtek SDK exploitation attacks documented the same entry point, showing how old flaws continue to give attackers access to routers, access points, repeaters, and other appliances. Researchers from Nozomi Networks identified Cling while examining a spike in exploitation attempts against CVE-2021-35394. Nozomi Networks said in a report shared with Cyber Security News (CSN) that the malware uses legitimate-looking STUN exchanges to register infected devices and receive operator commands. Published on…