As reported by The Hacker News, threat actors are actively exploiting CVE-2021-35394 — a five-year-old, critical remote code execution flaw in the Realtek Jungle SDK (CVSS 9.8) — to deploy a new botnet dubbed Cling. What makes this campaign noteworthy is not the initial exploit, which targets well-documented legacy vulnerabilities, but Cling's creative abuse of the STUN protocol to build a stealthy command-and-control channel that masquerades as legitimate NAT-traversal traffic.

Threat Alert: As reported by The Hacker News, threat actors are actively exploiting CVE-2021-35394 — a five-year-old, critical remote code execution flaw in the Realtek Jungle SDK (CVSS 9.8) — to deploy a new botnet dubbed Cling.

Why This Matters

The Cling botnet represents a meaningful evolution in low-cost, high-resilience C2 design. By leveraging public STUN infrastructure — the same protocol used by WebRTC, VoIP, and video conferencing applications — the operators have built a botnet whose network footprint blends into traffic that most security teams deliberately allow through their firewalls. Traditional network-based detection that relies on identifying suspicious destinations, unusual ports, or known malicious infrastructure will struggle here.

The campaign also underscores a persistent problem: IoT and edge device vulnerabilities have exceptionally long tails. CVE-2021-35394 was disclosed and patched years ago, yet it remains a reliable initial access vector because countless unpatched routers, DVRs, and embedded devices are still internet-exposed. Cling compounds this by chaining together seven additional CVEs spanning 2014 through 2025, targeting devices from Realtek, Linksys, MVPower, TBK, FiberHome, and others.

Who Is at Risk

Why This Matters
Organizations with exposed embedded devices: Routers, DVRs, and IoT hardware using Realtek Jungle SDK or any of the vulnerable product lines listed above.
Industrial and OT environments: Facilities with legacy network gear that receives infrequent patching and is rarely monitored for integrity.
Small and midsize networks: Consumer-grade and SOHO routers are prime targets and often lack centralized management or telemetry.

Detection: Beyond IoCs

Cling's STUN-based C2 follows a predictable pattern that defenders can hunt for. The malware sends STUN Binding Requests to a hard-coded list of 13 STUN servers approximately every 5 seconds, and critically, sets the transaction ID to all zeros instead of using a cryptographically random 96-bit value as the RFC 5389 specification requires. This is a detectable protocol anomaly.

Legitimate STUN clients generate random transaction IDs. A STUN Binding Request with a transaction ID of all zeros is a high-fidelity indicator of Cling or a similar abuse framework.

Additional detection opportunities include:

  • Outbound STUN traffic to non-standard or uncommon public STUN servers from devices that should not be initiating WebRTC-style sessions.
  • Persistence artifacts: binaries at /root/.cling or /usr/local/bin/.cling, and modifications to /etc/inittab, /etc/init.d/rcS, or /etc/rc.d/rc.boot.
  • A wget binary that has been replaced or moved — check for wget integrity on Linux-based embedded devices.
  • Socket binding on port 33957 with SO_REUSEADDR, which Cling uses as a single-instance lock.

Shield53 Recommendations

  • Patch or isolate vulnerable devices immediately. Apply vendor firmware updates for all affected CVEs. If patches are unavailable, remove the device from internet exposure or place it behind a restrictive firewall segment.
  • Inventory exposed embedded systems. Run external attack surface management scans to identify any internet-facing routers, DVRs, or IoT devices matching the affected product list.
  • Deploy STUN protocol anomaly detection. Create network rules to flag STUN Binding Requests with all-zero transaction IDs or STUN traffic from devices that have no legitimate need for NAT traversal.
  • Hunt for persistence on Linux-based edge devices. Check for unexpected files in /usr/local/bin/, modifications to init scripts, and verify the integrity of common utilities like wget.
  • Block unnecessary outbound STUN traffic. If your environment does not require WebRTC or VoIP from edge devices, block outbound UDP STUN traffic at the perimeter and monitor for attempts.
  • Monitor port 33957. Add detection for processes binding to port 33957 as a potential Cling indicator.

The broader lesson is clear: defenders cannot rely on reputation-based detection alone when attackers co-opt legitimate infrastructure and protocols. The future of effective network defense lies in protocol-level anomaly detection and aggressive patching of the long-tail vulnerability surface that IoT and edge devices represent.