Cling IoT Malware Masquerades as Google STUN Traffic to Hide C2 Communications

A newly observed IoT botnet named Cling exploits vulnerable internet-facing devices and disguises its command-and-control communications as legitimate STUN traffic, including packets that appear to originate from Google’s public STUN infrastructure. The technique lets operators hide malicious instructions amid common NAT-traversal traffic used by collaboration platforms, browsers, and real-time communication applications. Nozomi Networks Labs identified the activity while…

Diamond Model