Realtek Jungle SDK Exploit Attempts Deliver Cling Botnet With STUN-Based C2

Nozomi Networks reports a surge, starting around September 5, 2026, in attempts to exploit a patched critical Realtek Jungle SDK remote-code-execution flaw (CVE-2021-35394, CVSS 9.8), with part of the activity installing a new botnet strain called Cling. Beyond the Realtek bug, the malware carries exploit code for several other router and DVR vulnerabilities, including CVE-2014-8361 (Realtek SDK), CVE-2016-10372 (Eir D1000), CVE-2016-20016 (MVPower DVR), CVE-2023-26801 (LB-LINK), CVE-2023-41011 (FiberHome/China Mobile), CVE-2024-3721 (TBK DVR) and CVE-2025-34037 (Linksys), letting it spread across many unpatched device families. Once installed, Cling persists via init scripts or by replacing the wget binary, and it disguises its command-and-control traffic as ordinary STUN NAT-traversal exchanges, even making commands appear to originate from Google's public STUN service, to evade network monitoring while supporting self-propagation, proxying, tunneling and DDoS commands. Organizations running affected Realtek-based or vendor devices should apply available firmware patches promptly to prevent recruitment into the botnet.