OTX Threat: ClingSTUN Turns Vulnerable Edge Devices Into Attacker Infrastructure

An evolving Linux malware campaign deploys ClingSTUN, a back-connect proxy backdoor exploiting known vulnerabilities in Internet-facing IoT and network devices. The malware establishes persistent access and converts compromised systems into remotely controlled proxy nodes. Supporting multiple Linux architectures, ClingSTUN combines boot persistence, process termination, watchdog manipulation, proc CVEs: CVE-2017-7921, CVE-2021-21974, CVE-2021-3493, CVE-2022-21894, CVE-2021-4034