ClingSTUN IoT Botnet + Fake-Download Monetization Campaign: STUN C2 Abuse and Trojanized Installer Detection Pack

Two distinct but operationally significant campaigns surfaced in this pull of AlienVault OTX pulse data, and together they illustrate a converging trend in criminal infrastructure: the weaponization of legitimate protocols and legitimate software ecosystems to hide monetized compromise.

Campaign 1 — ClingSTUN / Cling IoT Botnet. Researchers at Fortinet and Nozomi Networks have documented a Linux backdoor family (tracked as ClingSTUN, with a related variant "Cling") that mass-exploits unpatched, internet-facing IoT and SOHO devices. The exploit arsenal spans a decade of vulnerabilities — CVE-2014-8361 (Realtek SOAP command injection), CVE-2016-10372, CVE-2016-20016, CVE-2021-35394, CVE-2023-26801, CVE-2023-41011, CVE-2024-3721, and CVE-2025-34037 among them — indicating an opportunistic, spray-and-compromise model rather than targeted intrusion. One pulse notes education-sector targeting. What makes this family distinctive is its command-and-control: it abuses public STUN (Session Traversal Utilities for NAT) infrastructure and STUN-protocol traffic to resolve external addresses and blend C2 into what looks like ordinary NAT-traversal / VoIP signaling. The malware also masquerades its traffic as Google services. The end product is a back-connect proxy botnet — compromised devices are rented out as relay infrastructure, almost certainly sold on underground proxy markets.

Campaign 2 — Trojanized Installer Monetization Operation. Microsoft Threat Intelligence tracks an evolving fake-download campaign luring users searching for cracked software, free games, activators, and unofficial utilities. Trojanized Inno Setup-style installers drop a branching payload ecosystem: OfferLoader (per-offer callback/status tracking), Wacatac, Kepavll, Egairtigado, Clover, AdvancedWindowsManager / "Windows Manager," and — critically — WorldProxyPool, which converts victim machines into residential proxy nodes, alongside CharityEngine/BOINC-based distributed computing abuse for resource theft. Persistence is via scheduled tasks. The objective is pure monetization: pay-per-install affiliate revenue, proxy bandwidth resale, and CPU-cycle harvesting.

The connective tissue: both campaigns monetize compromised machines as proxy infrastructure. Whether the victim is a consumer downloading a cracked game or an enterprise with an unpatched edge router, the adversary's endgame is the same — your bandwidth and IP reputation become criminal commodity inventory, resold on dark web proxy markets to launder other actors' traffic.

Threat Actor / Malware Profile

ClingSTUN / Cling (Linux IoT Backdoor)

Attribution: Unknown threat actor. No public clustering to a named group; consistent with financially motivated proxy-botnet operators.
Distribution: Mass exploitation of internet-facing IoT/SOHO/edge devices via a rotating CVE arsenal spanning Realtek SDK flaws (CVE-2014-8361, CVE-2021-35394), command injection, and remote code execution vulnerabilities across multiple vendors (CVE-2023-41011, CVE-2024-21887, CVE-2024-7029, CVE-2022-35555, CVE-2024-32314, CVE-2026-87827 among tagged indicators).
Payload behavior: Installs a persistent back-connect proxy backdoor. Infected devices accept inbound tasking and relay arbitrary TCP traffic, functioning as SOCKS-style proxy nodes.
C2 communication: Signature technique — abuse of public STUN servers (legitimate NAT-traversal infrastructure, frequently operated by Google and others) to discover externally mapped IP/port bindings. C2 traffic is crafted to resemble STUN (UDP/3478 and related ports), making malicious flows nearly indistinguishable from legitimate VoIP/WebRTC NAT-traversal behavior. One variant actively masquerades as Google service traffic.
Persistence: Survives via resident processes on the compromised embedded OS; reinfection pressure maintained by continuous internet-wide scanning/exploitation.
Anti-analysis: Blending into legitimate protocol traffic is the primary evasion layer — there is no exotic packer story here; the camouflage is the protocol itself.

Fake-Download Monetization Cluster (Windows)

Attribution: Unknown; per-offer callback and status-tracking infrastructure indicates a mature pay-per-install (PPI) affiliate operation with multiple downstream monetization branches.
Distribution: SEO-poisoned / malvertised fake download sites offering cracked commercial software, activators, free games, and utilities. Installers mimic Inno Setup packaging to appear legitimate.
Payload behavior: Multi-branch monetization: (1) WorldProxyPool converts the host into a residential proxy exit; (2) CharityEngine / BOINC abuse hijacks distributed-computing frameworks for unauthorized CPU monetization; (3) AdvancedWindowsManager / "Windows Manager" and OfferLoader manage ad-fraud and per-offer payload delivery; (4) Wacatac, Kepavll, Egairtigado, Clover serve as loaders/droppers in the chain.
C2 / tracking: Callbacks to offer-tracking domains including willowbox.xyz, friendsanchor.xyz, foldlodge.xyz, stonestation.cfd, prairielink.cfd, fallport.cfd, and wishcourt.cfd — note the pattern of freshly registered .xyz and .cfd TLDs.
Persistence: Scheduled tasks (explicitly tagged in pulse metadata) — expect tasks masquerading as legitimate updater/maintenance entries.
Anti-analysis: Inno Setup-style packaging defeats casual inspection; branching payloads ensure that even partial signature coverage leaves monetization components intact.

IOC Analysis

This pulse set contains three operational indicator classes, each requiring different handling:

1. CVE indicators (dominant class). The bulk of ClingSTUN/Cling indicators are CVEs, not atomic IOCs. These are exposure indicators, not compromise indicators. Operationalize them by: (a) cross-referencing against your asset inventory of internet-facing IoT/SOHO/edge devices, VPN concentrators, and network appliances; (b) prioritizing patch or isolation for CVE-2014-8361, CVE-2021-35394, CVE-2023-41011, CVE-2024-21887, and CVE-2016-20016, which appear across multiple pulses and are confirmed in-the-wild exploitation vectors.

2. Domain indicators (.xyz / .cfd offer-tracking domains). High-fidelity, short-lived. Feed willowbox.xyz, friendsanchor.xyz, foldlodge.xyz, stonestation.cfd, prairielink.cfd, fallport.cfd, and wishcourt.cfd into DNS sinkhole/proxy block lists immediately. Because PPI operators rotate domains rapidly, add behavioral alerting on any newly registered .cfd/.xyz domain resolution from endpoints — these TLDs carry a high base-rate of abuse in this campaign.

3. File hash indicators (SHA256). The installer hash 55cd3d36fdcc58016a64398357b2c9724a060da9f0d09266e537a61ec9552e4f should be swept across EDR telemetry and mail/web gateway caches. Expect low recurrence — Inno Setup repackaging means hash rotation is trivial — so pair hash blocking with behavioral detections below.

Tooling: OTX DirectConnect / the OTX v2 API for pulse subscription; MISP or OpenCTI for indicator normalization; Suricata/Zeek for STUN-anomaly network detection; your EDR's retrohunt (Defender, CrowdStrike, SentinelOne) for the hash and scheduled-task artifacts. CVE-to-asset mapping belongs in your VM platform (Tenable, Qualys, Rapid7).

Detection Engineering

YAML

---
title: ClingSTUN Botnet - Suspicious STUN Protocol Abuse for C2
id: 7a1f3c2e-9b4d-4e6a-b8c1-2d5e6f7a8b9c
status: experimental
description: Detects abnormal volumes of STUN traffic (UDP 3478) from Linux/IoT devices to public STUN infrastructure, consistent with ClingSTUN/Cling backdoor C2 masquerading as NAT-traversal traffic. Baseline legitimate VoIP/WebRTC hosts before deployment.
author: Security Arsenal Threat Intelligence
references:
    - https://www.fortinet.com/blog/threat-research/clingstun-linux-backdoor-abuses-public-stun-infrastructure
    - https://www.nozominetworks.com/blog/a-stunning-disguise-cling-malware-masquerades-as-google-
date: 2026/11/04
logsource:
    category: network_connection
    product: zeek
    service: conn
detection:
    selection_stun:
        id.resp_p:
            - 3478
            - 3479
            - 5349
        proto: udp
    filter_voip:
        id.orig_h|cidr:
            - '10.20.0.0/16'  # known VoIP/WebRTC VLAN - tune per environment
    condition: selection_stun and not filter_voip
fields:
    - id.orig_h
    - id.resp_h
    - id.resp_p
    - orig_bytes
    - duration
falsepositives:
    - Legitimate VoIP, WebRTC, and video-conferencing endpoints using STUN for NAT traversal
level: medium
tags:
    - attack.command_and_control
    - attack.t1071
    - attack.t1090
---
title: Fake-Download Campaign - Scheduled Task Persistence from Trojanized Installer
id: 8b2e4d3f-1c5a-4f7b-c9d2-3e6f7a8b9c0d
status: experimental
description: Detects scheduled task creation where the task action points to user-writable directories (AppData, Temp, Public), consistent with persistence used by WorldProxyPool, OfferLoader, and the fake-download monetization campaign delivered via trojanized Inno Setup installers.
author: Security Arsenal Threat Intelligence
references:
    - https://www.microsoft.com/en-us/security/blog/2026/11/03/fake-download-campaign-uses-trojanized-installers-deliver-monetization-payloads/
date: 2026/11/04
logsource:
    category: process_creation
    product: windows
detection:
    selection_schtasks:
        Image|endswith:
            - '\schtasks.exe'
        CommandLine|contains:
            - '/create'
    selection_path:
        CommandLine|contains:
            - '\AppData\'
            - '\Temp\'
            - '\Public\'
            - '\ProgramData\Microsoft\Windows\Caches\'
    condition: selection_schtasks and selection_path
fields:
    - CommandLine
    - ParentImage
    - User
falsepositives:
    - Software updaters and legitimate per-user application maintenance tasks
level: high
tags:
    - attack.persistence
    - attack.t1053.005
---
title: Trojanized Inno Setup Installer Dropping Monetization Payloads
id: 9c3f5e4a-2d6b-4a8c-d0e3-4f7a8b9c0d1e
status: experimental
description: Detects Inno Setup-style installers spawning suspicious child processes or writing executables to non-standard directories, matching the fake-download campaign delivering WorldProxyPool, BOINC abuse payloads, AdvancedWindowsManager, and OfferLoader.
author: Security Arsenal Threat Intelligence
date: 2026/11/04
logsource:
    category: process_creation
    product: windows
detection:
    selection_installer:
        ParentImage|contains:
            - 'unins'
        ParentCommandLine|contains:
            - '/VERYSILENT'
            - '/SILENT'
    selection_child:
        Image|endswith:
            - '\powershell.exe'
            - '\cmd.exe'
            - '\rundll32.exe'
            - '\wscript.exe'
            - '\schtasks.exe'
    selection_tmp_exec:
        CommandLine|contains:
            - 'is-'  # Inno Setup temp directory prefix
    condition: (selection_installer and selection_child) or selection_tmp_exec
fields:
    - Image
    - ParentImage
    - CommandLine
    - Hashes
falsepositives:
    - Legitimate Inno Setup-packaged software installations with post-install scripts
level: medium
tags:
    - attack.execution
    - attack.t1204.002
    - attack.t1059

KQL — Microsoft Sentinel / Defender

// Hunt: ClingSTUN STUN-C2 abuse + fake-download monetization campaign indicators
// Scope: Last 14 days. Part 1 hunts anomalous STUN egress; Part 2 hunts campaign domains/tasks.

// Part 1 - Abnormal STUN (UDP 3478/5349) egress from non-VoIP devices
let VoIPDevices = dynamic([]); // populate with known VoIP/WebRTC device IPs
DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where RemotePort in (3478, 3479, 5349)
| where ActionType == "ConnectionSuccess"
| where DeviceIPv4Dhcp !in (VoIPDevices)
| summarize STUNConnections = count(), DistinctSTUNServers = dcount(RemoteIP), STUNEndpoints = make_set(RemoteIP, 25)
    by DeviceName, DeviceIPv4Dhcp, bin(TimeGenerated, 1h)
| where STUNConnections > 50  // threshold: tune below VoIP baseline
| sort by STUNConnections desc;

// Part 2 - Fake-download campaign: offer-tracking C2 domains and persistence artifacts
let CampaignDomains = dynamic(["willowbox.xyz","friendsanchor.xyz","foldlodge.xyz","stonestation.cfd","prairielink.cfd","fallport.cfd","wishcourt.cfd"]);
union isfuzzy=true
(DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where RemoteUrl in (CampaignDomains)
| project TimeGenerated, DeviceName, RemoteUrl, RemoteIP, InitiatingProcessFileName, InitiatingProcessCommandLine, ReportType="NetworkIOC"),
(DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where FileName =~ "schtasks.exe" and ProcessCommandLine has "/create"
| where ProcessCommandLine has_any ("\\AppData\\","\\Temp\\","\\Public\\")
| project TimeGenerated, DeviceName, ProcessCommandLine, InitiatingProcessCommandLine, AccountName, ReportType="SuspiciousScheduledTask"),
(DeviceFileEvents
| where TimeGenerated > ago(14d)
| where SHA256 == "55cd3d36fdcc58016a64398357b2c9724a060da9f0d09266e537a61ec9552e4f"
| project TimeGenerated, DeviceName, FolderPath, FileName, SHA256, ReportType="InstallerHashIOC")
| sort by TimeGenerated desc

PowerShell

# Security Arsenal IOC Hunt - ClingSTUN proxy artifacts + fake-download campaign persistence
# Run as Administrator on suspected Windows endpoints; review output before remediation.

$report = @()

# --- 1. Scheduled tasks executing from user-writable paths (WorldProxyPool/OfferLoader persistence) ---
$susPaths = '\AppData\','\Temp\','\Public\'
Get-ScheduledTask | ForEach-Object {
    $task = $_
    foreach ($action in $task.Actions) {
        $exec = "$($action.Execute) $($action.Arguments)"
        foreach ($p in $susPaths) {
            if ($exec -like "*$p*") {
                $report += [PSCustomObject]@{
                    Type = 'ScheduledTask'
                    Name = $task.TaskName
                    Path = $task.TaskPath
                    Action = $exec
                    State = $task.State
                }
            }
        }
    }
}

# --- 2. Active connections to campaign offer-tracking domains ---
$campaignDomains = @('willowbox.xyz','friendsanchor.xyz','foldlodge.xyz','stonestation.cfd','prairielink.cfd','fallport.cfd','wishcourt.cfd')
foreach ($d in $campaignDomains) {
    try {
        $ips = (Resolve-DnsName -Name $d -ErrorAction Stop | Where-Object {$_.IPAddress}).IPAddress
        foreach ($ip in $ips) {
            $conns = Get-NetTCPConnection -RemoteAddress $ip -ErrorAction SilentlyContinue
            foreach ($c in $conns) {
                $proc = Get-Process -Id $c.OwningProcess -ErrorAction SilentlyContinue
                $report += [PSCustomObject]@{
                    Type = 'NetworkConnection'
                    Name = $d
                    Path = $c.RemoteAddress
                    Action = "Process: $($proc.ProcessName) (PID $($c.OwningProcess)) State: $($c.State)"
                    State = $c.State
                }
            }
        }
    } catch { }
}

# --- 3. Residential-proxy / BOINC-abuse process artifacts ---
$proxyProcs = @('worldproxypool','charityengine','boinc','advancedwindowsmanager','windows manager')
Get-Process | Where-Object { $n = $_.ProcessName.ToLower(); $proxyProcs | Where-Object { $n -like "*$_*" } } | ForEach-Object {
    $report += [PSCustomObject]@{
        Type = 'SuspiciousProcess'
        Name = $_.ProcessName
        Path = $_.Path
        Action = "PID $($_.Id) Started: $($_.StartTime)"
        State = 'Running'
    }
}

# --- 4. Abnormal UDP/3478 listeners or heavy STUN egress (proxy-backdoor relay check) ---
Get-NetUDPEndpoint -LocalPort 3478 -ErrorAction SilentlyContinue | ForEach-Object {
    $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
    $report += [PSCustomObject]@{
        Type = 'STUNListener'
        Name = $proc.ProcessName
        Path = $proc.Path
        Action = "Listening on UDP/3478 - PID $($_.OwningProcess)"
        State = 'Listen'
    }
}

if ($report.Count -gt 0) {
    $report | Format-Table -AutoSize
    $report | Export-Csv -Path "$env:TEMP\ioc_hunt_$(Get-Date -Format 'yyyyMMdd_HHmmss').csv" -NoTypeInformation
    Write-Host "[+] $($report.Count) suspicious artifacts found. CSV exported to TEMP." -ForegroundColor Yellow
} else {
    Write-Host "[-] No campaign artifacts detected on this host." -ForegroundColor Green
}

Response Priorities

Immediate (0-24h)

Block the seven campaign domains (willowbox.xyz, friendsanchor.xyz, foldlodge.xyz, stonestation.cfd, prairielink.cfd, fallport.cfd, wishcourt.cfd) at DNS, web proxy, and EDR network layers. Sweep EDR telemetry for the installer SHA256.
Inventory internet-facing IoT/SOHO/edge devices and appliances; flag anything matching the exploited CVE set (CVE-2014-8361, CVE-2021-35394, CVE-2023-41011, CVE-2016-20016, CVE-2024-21887, CVE-2024-3721, CVE-2023-26801, CVE-2025-34037). Isolate unpatchable devices behind ACLs immediately.
Deploy the STUN-anomaly detection and baseline legitimate VoIP/WebRTC STUN egress so the ClingSTUN C2 signature doesn't drown in false positives.
Hunt for scheduled tasks executing from AppData/Temp/Public and for unauthorized proxy/BOINC processes on endpoints.

24 Hours

Neither campaign is primarily credential-stealing, but residential-proxy compromise means your IPs may have been used as exits for third-party malicious traffic. Review egress logs from potentially affected edge devices and endpoints for connections attributable to downstream abuse; check IP reputation feeds (Spamhaus, AbuseIPDB) for your public ranges.
If WorldProxyPool or BOINC-abuse artifacts are confirmed on a host, treat as full compromise: reimage, rotate credentials used on that host (opportunistic stealers frequently co-reside in PPI chains), and review for lateral movement.
Verify no education-sector-specific exposure if you operate in that vertical — one pulse flags targeted activity.

1 Week

Eliminate IoT/edge attack surface: enforce firmware patch SLAs for network appliances, place all IoT devices on segmented VLANs with egress filtering (deny arbitrary UDP/3478 to non-approved STUN servers), and remove direct internet exposure wherever possible.
Software-supply hygiene: enforce application allowlisting or SmartScreen/WDAC policies to block unsigned Inno Setup installers from user-writable paths; address the user-behavior driver (cracked software downloads) through policy and awareness.
Add newly-registered-domain (NRD) blocking for high-risk TLDs (.cfd, .xyz) at the DNS layer, and establish a recurring OTX pulse ingestion pipeline so this indicator class refreshes automatically.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub