View Ridge Security
Back to Cyber Hose

ClingSTUN Backdoor Abuses STUN for C2, Exploits Dozens of IoT Flaws

A Linux backdoor dubbed ClingSTUN exploits dozens of IoT flaws and uses STUN for covert C2, plus healthcare breaches hit 250K+ and Meta rushes KVM escape fixes.

💥 BREACHES & INCIDENTS

  • Clover Health, AngMar breaches expose data of more than 250,000 people
    Data breaches at Clover Health Investments and AngMar Management Services exposed the PII and PHI of over 250,000 individuals.
    • Clover Health (NJ) and AngMar Management Services (TX), a home health/hospice support firm, are notifying affected individuals.
    • Clover Health reported 138,677 people affected; AngMar reported 126,196.
    • Clover's July breach stemmed from social engineering compromising three non-managerial employee accounts; stolen data included names, birth dates, insurance identifiers, and account numbers.
    • AngMar's breach involved the Interlock ransomware group, which claimed over 700 GB of stolen data including Social Security numbers, diagnoses, medical history, and prescription details.
    • Both companies notified HHS in September and were added to its data breach portal.
      📎 https://www.securityweek.com/250000-impacted-by-data-breaches-at-new-jersey-texas-healthcare-firms/ · 👁 via https://www.securityweek.com/250000-impacted-by-data-breaches-at-new-jersey-texas-healthcare-firms/

🕵️ RESEARCH & DEEP DIVES

  • ClingSTUN Linux Backdoor Abuses STUN Protocol for C2, Exploits Dozens of IoT Flaws
    Researchers have documented a Linux backdoor called ClingSTUN that exploits dozens of IoT vulnerabilities and uses public STUN servers as a covert command-and-control channel.

    • Targets Internet-facing routers, DVRs, and IoT devices from Avtech, EnGenius, D-Link, Hytec, Ivanti, Lantronix, Linear, MeiG, Realtek, Sunhillo, Tenda, and TP-Link, exploiting around two dozen flaws including CVE-2021-35394, CVE-2023-1389, CVE-2024-21887, and CVE-2024-7029.
    • Carries hardcoded exploits for seven additional vulnerabilities (China Mobile, KGUARD, Linksys, LB-LINK, MVPower, Realtek, TBK) for worm-like self-propagation, and supports x86-64, ARM, Intel 80386, MIPS, and PowerPC architectures.
    • Operates as a back-connect proxy, killing competing malware and watchdog timers, hiding as PID 1 via bind-mounts, and persisting through hidden executables and init scripts (/etc/inittab, /etc/init.d/rcS, /etc/rc.d/rc.boot).
    • C2 uses STUN Binding Requests to 13 hardcoded public STUN servers every 5 seconds, registering bots via custom UDP messages and receiving commands embedded in the STUN transaction ID field, making traffic look like legitimate NAT traversal; one tailored server at 145.249.115[.]184 was identified.
    • Nozomi Networks observed a spike in Realtek Jungle SDK CVE-2021-35394 exploitation starting around September 5, 2026 delivering the Cling botnet; commands enable scanning, TCP tunneling, proxying, and DoS attacks against targets including Minecraft servers.
    • Malware copies itself to /root/.cling and /usr/local/bin/.cling, and can replace the wget binary as an alternate persistence mechanism; single-instance check binds port 33957.
      📄 https://www.nozominetworks.com/blog/a-stunning-disguise-cling-malware-masquerades-as-google- · 📎 https://thehackernews.com/2026/10/realtek-jungle-sdk-exploit-attempts.html · 👁 via https://www.securityweek.com/linux-backdoor-abuses-stun-protocol-exploits-dozens-of-flaws/, https://thehackernews.com/2026/10/realtek-jungle-sdk-exploit-attempts.html

  • Meta rushed to fix Muse 'KVM escape' vulnerabilities in weeks before AI agent launch
    Meta engineers scrambled to fix Muse virtualization escape vulnerabilities before launch, at least one of which could have exposed internal Meta databases.

    • Applies to Meta Muse (internally 'Hatch'), a personal AI agent launched September 8, 2026, with each user's agent running in a dedicated Linux KVM virtual machine.
    • At least one vulnerability could have let a normal Muse user escape the VM and access sensitive internal Meta databases and production services.
    • Several vulnerabilities were in the underlying Linux kernel-based virtual machine (KVM) code, including an exploit found in July.
    • Meta executives acknowledged a 'sudden spike in reported KVM escapes' and ran a hardening push starting August 27, with security teams working nights and weekends; the issue was raised to Mark Zuckerberg.
    • Meta's bug bounty pays up to $300,000 for VM escape bugs; researcher Patrick Wardle called placing production access 'one KVM escape away' from user-root VMs inherently risky.
      📄 https://bugbounty.meta.com/payout-guidelines/muse/?ref=404media.co · 📎 https://www.404media.co/meta-rushed-to-fix-muse-vm-escape-vulnerability-immediately-before-launch/ · 👁 via https://www.404media.co/meta-rushed-to-fix-muse-vm-escape-vulnerability-immediately-before-launch/

  • GlassWorm-Linked Malware Hidden in Fake VS Code Theme Extensions on Marketplace and Open VSX
    Socket researchers found malicious VS Code theme extensions tied to the GlassWorm campaign delivering hidden malware loaders.

    • Targets VS Code developers via Visual Studio Marketplace and Open VSX; confirmed malicious extensions include Aurora Nocturne Night Theme (microsoftvs.microsoftvs) and Cosmic Nebula Themes (cosmic-themes.theme-cosmic-nebula), with Coca-Cola Christmas and Aurora Borealis Studio Theme drawing 8,000+ combined Marketplace installs.
    • Aurora Nocturne Night Theme shipped a 59KB obfuscated out/extension.js with zero-width Unicode-encoded payload that downloaded a Windows batch script from fingercakes4sale[.]store, saved it to %TEMP%\temp_batch.cmd, and silently ran it via cmd.exe; infrastructure tied to XWorm RAT.
    • Cosmic Nebula Themes decrypted an embedded JavaScript stage with AES-256-CBC, executed it via eval(), skipped Russian-locale/timezone systems, and used Solana transaction memos (address BjVeAjPrSKFiingBn4vZvghsGj9KCE8AJVtbc9S8o8SC) as a dead-drop to resolve follow-on payloads, matching GlassWorm fingerprints.
    • The cluster used brandjacking, name-squatting, shared Git identities, Russian-language code comments, and a promotional DEV Community article to appear credible; Microsoft removed reported Marketplace extensions after Socket's disclosure.
    • IOCs include SHA-256 5e68ca8c2097caccdb74d2752b85b85595a4bf646b442b8431a2416e87dbf268 (Aurora Nocturne out/extension.js), 684c877a52d226d50584cb886ca8ec5bec6355d4de853f406734c79d5b387804 (Cosmic Nebula JS), and domain fingercakes4sale[.]store.
      📄 https://socket.dev/blog/glassworm-vscode-themes · 📎 https://gbhackers.com/glassworm-supply-chain/ · 👁 via https://cybersecuritynews.com/glassworm-supply-chain-attack/, https://www.cryptika.com/glassworm-supply-chain-attack-uses-fake-vs-code-themes-to-deliver-hidden-malware/

  • Alleged Ploutus ATM malware developer Anibal Canelon Aguirre appears in US court after arrest
    The alleged developer of Ploutus ATM jackpotting malware, Anibal Alexander Canelon Aguirre, has been arrested and appeared in a Nebraska federal court.

    • Banks and credit unions across 47 US states, DC, and several foreign nations were targeted in Tren de Aragua-linked ATM jackpotting attacks between February 2024 and December 2025.
    • Over $5.4 million was stolen in at least 63 bank and 54 credit union ATM jackpottings, with losses exceeding $100,000 per incident; FBI says ATM hacking losses topped $20 million in 2025.
    • Ploutus malware forces ATMs to dispense cash without debiting accounts; attackers break into ATMs to install it, then activate it remotely and push dispense commands.
    • The malware included anti-analysis measures to hinder forensics, software protection against reverse-engineering and debugging, and self-deletion routines to conceal its presence from financial institution staff.
    • Canelon Aguirre, aka 'Prometheus,' was the first cybercriminal on the FBI's Ten Most Wanted list; he faces charges including bank fraud, money laundering, and material support to terrorism conspiracies, and DOJ has charged 98 suspects in the scheme since October 2025.
      📎 https://www.bleepingcomputer.com/news/security/suspected-dev-of-ploutus-atm-malware-appears-in-us-court-after-arrest/ · 👁 via https://www.bleepingcomputer.com/news/security/suspected-dev-of-ploutus-atm-malware-appears-in-us-court-after-arrest/

  • ZachXBT infiltrates Chinese syndicate laundering $1B+ for Lazarus, freezes $442K in Bybit funds
    Blockchain investigator ZachXBT posed as a client to infiltrate a Chinese laundering network tied to North Korea's Lazarus Group and helped freeze $442K in stolen Bybit funds.

    • Applies to crypto platforms and stolen-funds victims of the DPRK-linked Lazarus Group (TraderTraitor), including the $1.5B Bybit exploit of February 2025.
    • The syndicate allegedly laundered $1B+ across multiple exploits, including most of the stolen Bybit assets, operating from Hong Kong and mainland China.
    • ZachXBT posed as a client of an operator alias 'Jimmy Green' (Telegram user long_991, ID 7635649994), found via 15+ accounts seeking help with stolen Bybit funds in public Telegram and Discord groups.
    • He fronted 349.7K USDC on Ethereum, swapping USDC for USDT on Tron while accepting ~5% losses per order to build trust; the operator's wallet received gas from an address traceable to Bybit exploit funds.
    • Cross-referencing chats with THORChain and other explorers exposed a $12M+ wallet cluster moving funds across BTC, ETH, SOL and Tron via Uniswap pools and illiquid tokens; Tether froze 442K USDT at 0x652d7f9edaaa8891be2de74ea568d70af823d89e.
    • Related funds were traced to the Poloniex exploit (332K USDC frozen in 2024) and to a Huione Guarantee hot wallet holding ~$3M in fraud proceeds.
      📄 https://x.com/zachxbt/status/2107081638073319437 · 📎 https://www.hokanews.com/2026/10/zachxbt-details-infiltration-of-chinese.html · 👁 via https://cybersecuritynews.com/zachxbt-infiltrates-lazarus-group/, https://www.cryptika.com/researcher-infiltrates-lazarus-groups-crypto-laundering-network-after-1-5b-bybit-hack/

  • Microsoft warns of ClickFix fake CAPTCHA attacks hiding malware payloads in browser cache
    Microsoft Threat Intelligence has identified ClickFix attacks that pre-load malware into the browser cache disguised as PNG files before tricking users into executing it.

    • Affects Windows users visiting compromised websites; targets browser-stored and device credentials.
    • The payload is a VBScript pre-fetched into the browser profile cache (e.g., Firefox profile folder) disguised as a PNG-like resource, so no download occurs at execution time.
    • A fake CAPTCHA or repair prompt tells victims to press Win+R, paste a clipboard command, and run it; the command searches cache files by size match, copies the payload to a temp VBScript file, and launches it via Windows Script Host.
    • The VBScript uses WMI to gather device info, retrieves a PowerShell script, invokes .NET compilation tools, and injects code into timeout.exe to steal credentials; persistence uses a scheduled task running pythonw.exe.
    • IOCs include cocojambo[.]us[.]com/alfa, capsysnet[.]vg, ciliabula[.]cc, %LOCALAPPDATA%\Temp\t.vbs, v.ps1, cab.dat, and cache-file prefix f_.
      📄 https://x.com/MsftSecIntel/status/2106197481960706155 · 📎 https://cybersecuritynews.com/clickfix-fake-captcha-attack/ · 👁 via https://cybersecuritynews.com/clickfix-fake-captcha-attack/, https://www.cryptika.com/clickfix-fake-captcha-attack-executes-malware-hidden-inside-browser-cache/

📋 ADVISORIES

  • 📄 Source for Detained ShinyHunters suspect Saif al-Din Khader is reportedly helping the FBI track the group — https://www.metacurity.com/detained-shinyhunters-suspect-is-helping-the-fbi-track-the-group/

  • 📄 Source for Check Point weekly report: Arizona courts breach exposed 150,000+ foster care records via phishing — <https://research.check

Need help assessing your exposure?

Start with the free Posture Self-Check to see where you stand against the current threat landscape.

Free Posture Self-Check