😏 Critical vulnerability exploited to spread Cling botnet

Cybercriminals are actively attempting to leverage a critical security flaw in the Realtek Jungle Software Development Kit to distribute a new malware strain known as Cling. According to a detailed report from Nozomi Networks, this vulnerability has been patched but attackers continue trying to exploit unpatched systems. The Cling botnet distinguishes itself not for novel propagation techniques, but for its unique ability to convert standard Session Traversal Utilities for NAT (STUN) behavior into a practical command and control channel.

⚙️ Understanding the attack mechanism

Nozomi Networks reports that Cling excels at disguising malicious communications within legitimate-looking STUN traffic. This protocol is commonly used for VoIP and video conferencing applications to traverse network address translators, which means many firewalls allow STUN packets to pass without inspection. By embedding command and control instructions within this expected traffic pattern, attackers can maintain persistent communication with infected devices while evading traditional security monitoring tools that rely on port-based filtering or signature detection.

The Realtek Jungle SDK is embedded in numerous IoT devices ranging from smart home appliances to networking equipment. While manufacturers have released patches, the extended lifespan of many embedded devices means vulnerable systems remain operational across enterprise and residential networks worldwide.

❔ Why STUN makes detection difficult

STUN-based C2 channels represent a sophisticated evasion strategy. Security teams face several challenges when defending against this technique:

▫️ Legitimate traffic masking: Malicious commands blend with genuine STUN requests from VoIP phones, video conferencing systems, and gaming applications
▫️ Port flexibility: STUN commonly operates over UDP ports 3478 and 3479, but can use any port, making port-blocking ineffective
▫️ Payload analysis required: Detecting Cling demands deep packet inspection rather than simple connection blocking
▫️ Persistence mechanisms: Even if initial infection vectors are closed, existing compromised devices can reactivate using alternative update servers

😊 If you enjoyed the article share it with your friends and follow us.

#Realtek #JungleSDK #ClingBotnet #IoTSecurity #ZeroDay

@PrivacyNotACrime 🗽 ⌨️ Chat