Cybersecurity specialists have detected attempts by threat actors to exploit a critical vulnerability in the Realtek Jungle software development kit (SDK) to distribute Cling botnet malware. This flaw, which has since been patched, is identified as CVE-2021-35394 and has a CVSS score of 9.8. The malware was first observed in action around early September 2026, aiming to capitalize on a remote code execution (RCE) vulnerability.
Cling Botnet’s Unique Approach
According to a recent report by Nozomi Networks, Cling does not employ a groundbreaking propagation method. Instead, it cleverly manipulates ordinary STUN (Session Traversal Utilities for NAT) behavior to function as a command-and-control (C2) channel. This technique allows the botnet’s traffic to mimic legitimate NAT-traversal activities while facilitating commands such as propagation, tunneling, and denial-of-service attacks.
The malware is designed to exploit various command injection and RCE vulnerabilities, particularly in routers and DVRs from multiple manufacturers. Once deployed, Cling ensures it persists on systems by copying itself to specific directories and modifying system initialization files. An alternative method involves replacing the system’s wget binary with the malware, ensuring execution when legitimate processes call the command.
STUN Protocol Exploitation
Cling’s use of the STUN protocol is a significant aspect, as it utilizes the seemingly innocuous traffic of public STUN infrastructure to manage infected devices. The malware employs a four-step process for C2 communication, which includes sending STUN Binding Requests to a set of servers and registering infected hosts through custom messages.
The custom registration messages, however, do not conform to standard STUN protocol definitions, leading legitimate servers to drop these packets. Notably, one server did respond with an all-zero transaction ID, indicating potential collaboration with the botnet operators.
Implications and Future Risks
Cling’s ability to disguise its commands as legitimate STUN traffic poses a challenge for network monitoring, as these activities can easily be mistaken for normal server interactions. The malware’s operator can issue commands to expand the botnet, initiate TCP tunnels, and execute denial-of-service attacks on specified targets, such as South Korean ISPs and online services like Minecraft servers.
Nozomi Networks has highlighted how the commands appear to originate from well-known STUN services, adding a layer of complexity in detecting malicious activities. As cybersecurity threats continue to evolve, it becomes increasingly vital for organizations to stay vigilant and update their systems to mitigate such vulnerabilities.
In conclusion, the exploitation of the Realtek Jungle SDK vulnerability by the Cling botnet underscores the ongoing challenges in cybersecurity. Organizations must prioritize the patching of known vulnerabilities and enhance their monitoring capabilities to defend against sophisticated botnet operations.
