Cling Botnet Reuses STUN Traffic to Evade Detection on 2021-Patched Realtek Devices

Nozomi Networks telemetry shows exploit attempts chaining eight known router and DVR flaws, including CVE-2014-8361 and CVE-2025-34037, to drop Cling binaries that bind port 33957 for single-instance checks and append themselves to inittab and rcS for persistence. The malware replaces wget on some systems to survive legitimate calls. Daily life impact is direct: infected home routers and DVRs become proxies or DDoS nodes, raising latency for remote workers and exposing household traffic patterns that insurers or employers could later use.

The STUN abuse is the operational shift. Cling sends zeroed transaction IDs and non-compliant registration datagrams; only one server at 145.249.115[.]184 replies anomalously, letting operators track new bots while the remaining twelve discard packets as invalid. This produces traffic indistinguishable from legitimate WebRTC or VoIP keep-alives on most enterprise sensors.

Procurement records from 2024 show Realtek SDK still shipping in low-cost surveillance and broadband gear; the September spike therefore maps to unpatched stock rather than zero-days. Independent CVE feeds confirm no new patch campaign since 2021, leaving millions of devices reachable from the public internet.

Next phase will likely be loader updates that add more STUN servers or migrate to QUIC-based tunnels once operators observe takedown pressure on the current thirteen.