Nozomi Networks Labs has identified a Cling campaign targeting internet-accessible devices running affected Realtek Jungle SDK versions 2.0–3.4.14B.
Targets include some LB-LINK and Linksys routers, Eir routers, FiberHome devices and TBK or MVPower video recorders.
Cling attempts to persist after a reboot and search for other vulnerable devices; its communications can resemble connection messages used by Microsoft Teams, Zoom…