{"id":3383,"date":"2026-10-05T14:32:55","date_gmt":"2026-10-05T14:32:55","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=3383"},"modified":"2026-10-05T14:32:55","modified_gmt":"2026-10-05T14:32:55","slug":"realtek-jungle-sdk-exploit-attempts-deliver-cling-botnet-with-stun-based-c2","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=3383","title":{"rendered":"Realtek Jungle SDK Exploit Attempts Deliver Cling Botnet With STUN-Based C2"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Oct 05, 2026<\/span><\/span>Vulnerability \/ Malware<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

Threat actors have been observed attempting to exploit a now-patched critical security flaw impacting the Realtek Jungle software development kit (SDK) to deploy a botnet malware called Cling<\/strong>.<\/p>\n

\u00abCling is notable not because it introduces a new propagation technique, but because it repurposes ordinary STUN behavior into a practical command-and-control channel,\u00bb Nozomi Networks said<\/a> in a report published last week. \u00abThe result is a botnet whose traffic can resemble legitimate NAT-traversal activity while still supporting propagation, proxying, tunneling and denial-of-service commands.\u00bb<\/p>\n

The operational technology (OT) security company said it observed a spike in attempts to exploit CVE-2021-35394 (CVSS score: 9.8), a critical remote code execution (RCE) flaw<\/a> in Realtek Jungle SDK starting around September 5, 2026, with a subset of the activity delivering Cling.<\/p>\n

An analysis of the malware sample has found it to embed exploit logic for various command injection and RCE vulnerabilities impacting routers and DVRs from multiple vendors –<\/p>\n

\u00abThe single-instance check to only run one copy involves binding a socket with SO_REUSEADDR to port 33957 and exiting cleanly if it fails,\u00bb Nozomi Networks said. \u00abThe sample copies itself to \/root\/.cling and \/usr\/local\/bin\/.cling. Both executables are appended to \/etc\/inittab, \/etc\/init.d\/rcS, \/etc\/rc.d\/rc.boot, thus achieving persistence on SysV and BusyBox init systems.\u00bb<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

An alternative persistence mechanism involves identifying the wget binary on the infected system and then replacing it with the malware, but not before moving the original to another location. This, in turn, causes the malware to be executed when a legitimate process invokes the \u00abwget\u00bb command.<\/p>\n

<\/p>\n

A notable aspect of Cling is its abuse of harmless-looking STUN traffic and public STUN infrastructure to register infected hosts, receive operator commands, and make malicious activity less obvious from a network monitoring perspective.<\/p>\n

STUN, short for Session Traversal Utilities for Network Address Translation (NAT), is a standardized network protocol that’s designed to assist devices behind a NAT or firewall in establishing peer-to-peer real-time communications.<\/p>\n

Specifically, the malware follows a four-step process for command-and-control (C2) communications –<\/p>\n