🔴 Critical: Realtek Jungle SDK Exploit Attempts Deliver Cling Botnet With STUN-Based C2
-
Threat actors are attempting to exploit a critical security flaw in the Realtek Jungle SDK to deploy a botnet malware tracked as Cling, according to research from Nozomi Networks. The vulnerability in question has already been patched, but unpatched devices remain at risk from ongoing exploitation attempts.
What stands out about Cling is not its spread mechanism, but how it abuses an everyday networking protocol. According to Nozomi Networks, the malware repurposes ordinary STUN (Session Traversal Utilities for NAT) behavior into a practical command-and-control channel. Since STUN traffic is common and generally trusted on many networks, this approach helps the botnet blend in and makes detection harder for defenders relying on traditional C2 signatures.
Key points to note:
- The targeted flaw affects the Realtek Jungle SDK and has been fixed, meaning the risk is concentrated among systems that have not yet applied the patch.
- Cling uses STUN as its C2 channel rather than a bespoke or obvious protocol.
- The technique is described as a repurposing of normal STUN behavior, not a newly invented propagation method.
- Organizations running Realtek SDK-based devices should prioritize patching and monitor for unusual STUN traffic patterns.
Source: The Hacker News
Does your organization rely on Realtek SDK-based devices, and have you already patched them given these ongoing exploitation attempts?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login