Cling Botnet Encodes C2 Commands in STUN Traffic to Evade Network Detection

Nozomi Networks Labs has uncovered Cling, a botnet that infects exposed IoT and networking devices while hiding command traffic inside exchanges resembling legitimate STUN activity. Published on October 1, 2026, the research shows how attackers blend malicious instructions with traffic normally used by communication applications. Researchers discovered the malware while investigating increased exploitation of CVE-2021-35394, a remote code execution flaw in the Realtek Jungle…

Diamond Model