Cling malware turns STUN traffic into covert botnet control

At a glance

What this is: This analysis shows how Cling malware repurposes STUN traffic and public STUN servers to conceal botnet registration, command delivery and disruptive activity.

Why it matters: It matters because defenders that treat STUN and other NAT-traversal traffic as routine may miss malware command channels that blend into legitimate network behaviour.

Context

Cling is a botnet that hides control traffic inside STUN, a protocol normally used for NAT traversal and real-time communications. That matters because security monitoring often treats high-reputation protocol traffic as low-risk unless the surrounding behaviour is clearly malformed or blocked.

The governance gap is not that STUN is unsafe by design, but that attackers can exploit the trust defenders place in ordinary-looking protocol flows. In environments that depend on edge devices, appliances and unmanaged internet-facing systems, that trust gap can make malware traffic look like background noise rather than active command and control.

Key questions

Q: What breaks when malware hides command and control inside STUN traffic?

A: Traditional network controls break because they often treat STUN as routine NAT-traversal traffic and stop short of checking whether the message fields behave as the protocol requires. When attackers hide commands in transaction IDs or use custom datagrams, defenders need semantic inspection, not just protocol classification. Otherwise, the control plane blends into legitimate background noise.

Q: Why do exposed IoT and networking devices keep turning into botnet footholds?

A: These devices often run embedded SDKs, receive slow or inconsistent patching and remain internet-exposed long after their original deployment assumptions have changed. That combination makes them durable entry points for opportunistic exploitation. Once compromised, they can be reused for scanning, proxying or denial-of-service activity unless teams actively inventory, isolate and retire them.

Q: How can security teams tell whether STUN traffic is being abused as a covert channel?

A: Look for protocol behaviour that deviates from RFC expectations, especially repeated all-zero transaction IDs, custom payloads to public STUN servers and response patterns that do not match normal request-response semantics. Also correlate timing, destination diversity and follow-on scans. The goal is to separate ordinary NAT traversal from traffic that is clearly being used as a control channel.

Q: Should teams focus first on blocking exploitation or on containing infected appliances?

A: Both matter, but containment should follow quickly when compromise is already likely. Blocking exploitation reduces new infections, yet exposed appliances can already be running persistence logic and reactivating through ordinary utilities. Teams should isolate suspicious devices, verify startup paths and then close the internet-facing exposure that allowed the initial compromise.

Technical breakdown

How Cling turns STUN into a registration channel

STUN is designed to help a device discover its public IP address and NAT-mapped port. Cling abuses that normal exchange by sending Binding Requests to public STUN servers, collecting the returned mapped ports and then using a custom registration datagram to tag the infected host. The important technical detail is that the malware does not need to invent a new transport. It piggybacks on a legitimate protocol flow, which means network tools that key on protocol presence alone will miss the abuse unless they inspect message structure, timing and field usage.

Practical implication: Inspect STUN message structure and transaction behaviour, not just protocol labels, when hunting for botnet registration activity.

How STUN transaction IDs become command delivery

In normal STUN, the transaction ID is meant to be unpredictable and used to match requests with responses. Cling instead hides operator commands inside that field, turning a 12-byte value into a covert instruction carrier. That is protocol subversion rather than simple tunnelling. Because the command is embedded in a field defenders often treat as housekeeping metadata, basic packet filters and allowlists can miss the control plane entirely. The result is a command channel that looks like ordinary NAT-traversal traffic unless teams validate protocol conformance and field semantics.

Practical implication: Validate STUN field behaviour against RFC expectations and alert on non-random or repeated transaction IDs.

Why this botnet survives on edge devices and persistence tricks

Cling targets internet-exposed devices that often remain unpatched for years, then establishes persistence by copying itself into common locations and inserting startup references into init scripts. It also replaces wget with a wrapper so future wget calls can trigger reinfection or reinvocation. That combination matters because the initial exploit is only part of the problem. Once the malware survives reboot and can re-enter through common utilities, cleanup becomes an access and lifecycle issue as much as a malware-removal task. This is especially relevant on routers and appliances where normal software management is weak. See the Edge Device Security Guide.

Practical implication: Treat exposed appliances as lifecycle-managed assets and verify startup scripts, binary integrity and command-tool replacement paths.

Threat narrative

Attacker objective: The attacker wants a reusable botnet that is hard to spot in network telemetry and can be directed to propagate, proxy traffic and conduct flooding attacks.

1. Entry begins with exploitation attempts against internet-exposed devices using CVE-2021-35394 and related command-injection vulnerabilities.
2. Credential or control access is then established when the malware executes downloaded payloads and installs itself for persistence on the vulnerable host.
3. Command and control is maintained through STUN-like traffic that registers the host, receives operator instructions and disguises malicious exchanges as legitimate NAT-traversal behaviour.
4. Impact follows when the botnet is instructed to scan for more vulnerable systems, proxy traffic, start tunnels or launch denial-of-service floods.

Breaches seen in the wild

• Gladinet Hard-Coded Keys RCE Exploitation: Actively exploited hard-coded keys in Gladinet CentreStack and Triofox enable remote code execution.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Protocol camouflage is now a practical command-and-control technique, not just an evasion idea. Cling demonstrates that defenders can no longer assume a familiar protocol implies benign behaviour. When attackers embed control data in a field that is normally treated as metadata, visibility has to move from coarse protocol classification to semantic inspection. The governance implication is clear: if monitoring does not validate expected field behaviour, it will miss malware that hides in plain sight. Practitioners should treat protocol conformance as part of detection design.

Edge-device exposure remains the soft underbelly of botnet formation. The article is strongest when it shows how old vulnerabilities on routers, access points and similar devices still produce fresh compromise opportunities. That is a lifecycle failure, not a one-off patch issue. A device that stays internet-exposed for years without reliable updates becomes a durable recruitment point for botnets and a persistent source of hidden traffic. Teams should manage these assets as high-risk perimeter identities, with continuous exposure review and remediation discipline. See edge device security.

Persistence on appliances is often achieved by abusing normal administration pathways. Cling does not rely on exotic kernel compromise. It uses startup files, binary replacement and common utilities such as wget to survive reboot and re-enter the system. That pattern should change how teams think about appliance containment: the threat is not only the malware binary, but the maintenance workflow it hijacks. If the trusted admin path can be rewritten, the device is already operating outside its intended governance boundary.

Command concealment in high-reputation traffic raises the bar for network triage. Traffic that appears to come from public STUN infrastructure will often be deprioritised by analysts and tools alike. Cling exploits that bias by making commands look like replies from familiar services, which complicates both alerting and manual investigation. The lesson is not simply to block STUN. It is to build trust decisions into network detection so that high-reputation sources are still evaluated for behavioural anomalies. That is a detection-governance problem as much as a malware problem.

What this signals

Protocol trust will become a bigger detection blind spot: attackers increasingly use legitimate services and familiar transport patterns to hide control traffic. The practical response is to move detections up the stack, from simple allow/deny logic to behaviour that understands what a protocol should do, not just what port it uses.

Edge appliance governance is part of malware defence: unmanaged routers and gateways are not just network equipment, they are high-value compromise surfaces. Programmes that cannot inventory, patch and retire these devices will keep seeing the same exposure pattern, regardless of how strong their endpoint controls are.

For practitioners

• Hunt for STUN protocol anomalies Baseline normal STUN usage in your environment, then flag repeated all-zero or otherwise non-random transaction IDs, custom datagrams and unusual registration behaviour to public STUN servers. See the Command and Control (C2) Guide.
• Prioritise exposed IoT and networking devices Inventory internet-facing routers, access points, repeaters and other appliances that embed older SDKs, then patch, replace or isolate any device still exposed on vulnerable interfaces.
• Check startup persistence and binary tampering Review init scripts, startup files and common utilities such as wget for unexpected replacements, renamed binaries or inserted execution paths that survive reboot.
• Block opportunistic exploitation paths at the edge Reduce exposure for appliances that accept command injection or diagnostic payloads from the internet, and suppress unauthorised inbound management and download activity.

Key takeaways

• Cling shows that botnets can hide command and control inside ordinary-looking STUN traffic, which weakens any monitoring model that relies on protocol reputation alone.
• The compromise pattern starts with exposed IoT and networking devices, then moves into persistence through startup files and utility replacement, which makes cleanup a lifecycle problem as well as a malware problem.
• Defenders need semantic protocol inspection, exposed-device inventory and persistence checks on appliances if they want to catch this class of abuse early.

Related NHI Mgmt Group resources: Command and Control (C2) Guide · Edge Device Security Guide · Top 10 Network Security Misconfigurations · NHI Lifecycle Management Guide · Gladinet Hard-Coded Keys RCE Exploitation

Key terms

• STUN Transaction ID Abuse: A covert technique that repurposes the STUN transaction ID field to carry attacker instructions instead of protocol bookkeeping. It matters because defenders may trust STUN traffic as ordinary NAT-traversal noise, while the command channel is actually hidden in data that should be random and protocol-conformant.
• Persistence Camouflage: Persistence camouflage is the use of believable service, task, or agent names to hide auto-start mechanisms on a host. The technique works because administrators often scan for obviously malicious names, while plausible labels blend into routine operating system noise.
• Edge Device Persistence: A persistence pattern where malware survives reboot by modifying startup scripts, replacing common utilities or storing copies in expected system paths. On appliances and embedded systems, this is especially damaging because routine administration workflows can unintentionally trigger the malware again.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. Explore nhimg.org for resources that connect identity governance to the broader security disciplines your programme depends on.