Cybersecurity
Cling botnet exploited Realtek Jungle SDK flaw
Nozomi Networks said it saw exploitation of CVE-2021-35394 in Realtek Jungle SDK from around 5 September 2026, with some attempts delivering Cling and using STUN traffic for command and control.
- Nozomi Networks said it saw a rise in attempts to exploit CVE-2021-35394 in Realtek Jungle SDK from around 5 September 2026.
- It said some of that activity delivered the Cling botnet malware.
- Nozomi said Cling used STUN servers for command-and-control traffic and included code for several router and DVR vulnerabilities.
- Fortinet FortiGuard Labs said in a report dated 5 October 2026 that it called the malware ClingSTUN and linked it to unpatched internet-facing devices.
Nozomi Networks said it observed a spike in attempts to exploit CVE-2021-35394 in Realtek Jungle SDK from around 5 September 2026, and that some of the activity delivered Cling. It said the malware used STUN traffic so that its communications could resemble ordinary network activity.
The company said the sample contained exploit logic for several router and DVR flaws from different vendors. It also said Cling used two persistence methods: copying itself to system paths and startup files, or replacing the wget binary after moving the original.
Nozomi described a four-step command-and-control process built around 13 hard-coded STUN servers. It said the malware sent repeated Binding Requests, recorded returned ports, registered infected hosts with custom UDP messages, and then polled for commands carried in the STUN transaction ID field.
The report said one server at 145.249.115.184 returned an all-zero transaction ID, which Nozomi said suggested a server tailored to the botnet. It also said commands were used to scan and spread the botnet, start or stop TCP tunnels and proxies, and launch denial-of-service attacks.
In an update, Fortinet FortiGuard Labs said on 5 October 2026 that the malware, which it named ClingSTUN, exploited unpatched internet-facing devices. Fortinet said it used shell script downloaders for multiple Linux architectures and hard-coded exploits for seven vulnerabilities to spread and maintain access.
Named in this story
Companies
- Nozomi Networks
- reported the exploitation spike and analysed Cling
- Fortinet FortiGuard Labs
- published an update report and named the malware ClingSTUN
Products and systems
- Realtek Jungle SDK
- was the vulnerable software development kit under attack
- Cling
- was the botnet malware delivered by some exploitation attempts
- ClingSTUN
- was Fortinet’s name for the malware
How the source tells it
The piece read as a technical incident report with a warning edge, driven mainly by the claim that the malware hid inside ordinary-looking STUN traffic.
- alarm loaded security language framed the activity as a critical flaw, threat actor operation and botnet abuse
- stealth and disguise the malware was described as blending into legitimate STUN and VoIP-style traffic while carrying commands