SysV/BusyBox startup persistence

ClingSTUN Malware Uses Public STUN Servers to Turn Unpatched IoT Devices Into Proxy Nodes

Researchers say the campaign hides control signals inside normal STUN traffic so defenders must inventory, patch and isolate exposed devices to limit abuse.