[cling]

October 6, 2026

• Fortinet traced additional infection paths for CLING/ClingSTUN. Beyond the Realtek activity in earlier coverage, researchers observed delivery through CVE-2022-36553, followed by CVE-2025-34035 and CVE-2024-23625. The Linux implant turns IoT devices into back-connect proxies and uses public STUN services to learn external mappings, preserve NAT bindings and blend communications with WebRTC and VoIP traffic. Fortinet · Threat Activity & Espionage

in A Trusted Company Connection Exposes 8.8 Million Danish CPR Records

October 4, 2026

• A new IoT botnet, CLING, hides its C2 inside STUN traffic. Nozomi Networks Labs says the malware infects internet-facing routers, cameras and DVRs, then repeatedly contacts public STUN servers — the same NAT-traversal protocol browsers and voice/video apps use — to register infected devices and receive commands, giving it C2 that blends into ordinary real-time-communications noise (Nozomi Networks Labs). · Threat Activity

in AI on Both Ends of the Exploit Chain