Cling malware: what it means for network monitoring and OT teams

TL;DR: Cling malware abuses STUN traffic and public STUN infrastructure to register infected hosts, receive commands and hide botnet activity inside what can look like legitimate NAT-traversal noise, according to Nozomi Networks Labs. That pattern makes protocol trust, not just payload inspection, a decisive control point for defenders.

Editorial analysis by NHI Mgmt Group, based on content published by Nozomi Networks: “A STUNning Disguise: Cling Malware Masquerades as Google”.

Key questions

Q: What breaks when malware hides command and control inside STUN traffic?

A: Traditional network controls break because they often treat STUN as routine NAT-traversal traffic and stop short of checking whether the message fields behave as the protocol requires.

Q: Why do exposed IoT and networking devices keep turning into botnet footholds?

A: These devices often run embedded SDKs, receive slow or inconsistent patching and remain internet-exposed long after their original deployment assumptions have changed.

Q: How can security teams tell whether STUN traffic is being abused as a covert channel?

A: Look for protocol behaviour that deviates from RFC expectations, especially repeated all-zero transaction IDs, custom payloads to public STUN servers and response patterns that do not match normal request-response semantics.

Practitioner guidance

• Hunt for STUN protocol anomalies Baseline normal STUN usage in your environment, then flag repeated all-zero or otherwise non-random transaction IDs, custom datagrams and unusual registration behaviour to public STUN servers.
• Prioritise exposed IoT and networking devices Inventory internet-facing routers, access points, repeaters and other appliances that embed older SDKs, then patch, replace or isolate any device still exposed on vulnerable interfaces.
• Check startup persistence and binary tampering Review init scripts, startup files and common utilities such as wget for unexpected replacements, renamed binaries or inserted execution paths that survive reboot.

Bottom line: Cling shows that botnets can hide command and control inside ordinary-looking STUN traffic, which weakens any monitoring model that relies on protocol reputation alone.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →