<![CDATA[🔴 Critical: Realtek Jungle SDK Exploit Attempts Deliver Cling Botnet With STUN-Based C2]]>Threat actors are attempting to exploit a critical security flaw in the Realtek Jungle SDK to deploy a botnet malware tracked as Cling, according to research from Nozomi Networks. The vulnerability in question has already been patched, but unpatched devices remain at risk from ongoing exploitation attempts.

What stands out about Cling is not its spread mechanism, but how it abuses an everyday networking protocol. According to Nozomi Networks, the malware repurposes ordinary STUN (Session Traversal Utilities for NAT) behavior into a practical command-and-control channel. Since STUN traffic is common and generally trusted on many networks, this approach helps the botnet blend in and makes detection harder for defenders relying on traditional C2 signatures.

Key points to note:

  • The targeted flaw affects the Realtek Jungle SDK and has been fixed, meaning the risk is concentrated among systems that have not yet applied the patch.
  • Cling uses STUN as its C2 channel rather than a bespoke or obvious protocol.
  • The technique is described as a repurposing of normal STUN behavior, not a newly invented propagation method.
  • Organizations running Realtek SDK-based devices should prioritize patching and monitor for unusual STUN traffic patterns.

Source: The Hacker News

Does your organization rely on Realtek SDK-based devices, and have you already patched them given these ongoing exploitation attempts?

]]>https://xploitlk.com/topic/584/critical-realtek-jungle-sdk-exploit-attempts-deliver-cling-botnet-with-stun-based-c2RSS for NodeTue, 27 Oct 2026 09:50:33 GMTTue, 06 Oct 2026 04:30:27 GMT60