Your broadband bill should cover your business. Not somebody else’s side hustle.
Most connected office equipment gets very little attention once it works. The router sits in a cupboard. The CCTV recorder hums away. A smart display shows the meeting room bookings, occasionally with more confidence than accuracy.
That quiet usefulness is precisely why connected devices deserve a place in your security planning. They can have software vulnerabilities, internet access and years of uninterrupted operation. If someone compromises them, they may get more than access to the device itself.
They may get a route through your business internet connection.
Meet the unwanted passenger
ClingSTUN is malware associated with turning vulnerable connected devices into proxy infrastructure. In plain English, an affected device can become a stepping stone for someone else’s internet traffic.
A proxy passes traffic onwards. There are legitimate reasons to use one, but secretly recruiting a business’s equipment is not among them.
For a business owner, the important point isn’t the malware’s name. It’s where that traffic appears to come from. When activity leaves through your connection, external services may see your public internet address rather than the original sender’s.
Your office could therefore become part of somebody else’s operation without anyone on your team deliberately installing anything or agreeing to help.
That doesn’t mean every connected device is infected. It does mean that “it still works” isn’t much of a security assessment.
The risk isn’t just a slower connection
Unexpected traffic might use bandwidth or make an already busy connection less reliable. But speed is only part of the concern.
If your internet address becomes associated with suspicious activity, services may challenge, restrict or block traffic from it. Staff could encounter extra verification checks or find that a service they rely on no longer behaves normally.
Investigating complaints about traffic from your address can also consume time. Someone has to establish which device was involved, what happened and whether anything else needs attention.
None of those symptoms proves that ClingSTUN, or any other malware, is present. Slow broadband has plenty of ordinary causes, including an enthusiastic cloud backup at precisely the wrong moment.
The practical lesson is to investigate unusual behaviour rather than immediately buying a faster connection. More bandwidth won’t remove an unwanted passenger.
Start with the cupboard, not the shopping list
Before buying security tools, find out what you already have.
Build an inventory of connected equipment across your premises. Include routers, wireless access points, cameras, recorders, printers, door-entry systems, meeting room equipment and building controls where relevant.
For each device, record its model, purpose, location, support status and who looks after it. Identify whether it can be reached from the internet and whether remote access is actually necessary.
The ownership question matters. Equipment installed by a landlord, alarm contractor or previous IT supplier can fall into a gap where everybody assumes somebody else maintains it.
Ask who applies updates, who holds administrator access and who will act if a vulnerability is reported. “The chap who fitted it” is a starting point, not a maintenance plan.
Close the doors you don’t use
Review internet-facing access carefully. A device’s administration page generally shouldn’t be exposed publicly just because remote management was convenient during installation.
Check port-forwarding rules and remote-access features with your IT provider. Remove access that has no current business purpose. Where remote administration is needed, use an appropriately secured method rather than leaving a management interface open to everyone.
Change default administrator credentials and avoid reusing passwords between devices. Enable multi-factor authentication where it’s supported.
Check firmware updates against the manufacturer’s guidance. Plan changes around business needs, particularly for equipment involved in security or building operations.
If the manufacturer no longer provides security updates, consider replacement. A device can remain perfectly functional while becoming increasingly difficult to defend. Working and safe are different questions.
Give connected kit its own space
A camera needs to do its job. It rarely needs unrestricted access to your finance team’s computers.
Network segmentation separates groups of devices and controls the connections between them. That might mean keeping building equipment apart from staff laptops, with only the access required for each system to work.
A separate network name alone isn’t proof of proper isolation. The underlying firewall rules and routing need to match the intention.
Outbound access deserves attention too. Where practical, limit devices to the destinations and services they genuinely need. Blanket restrictions can break legitimate features, so assess requirements and test changes rather than guessing.
Segmentation won’t repair vulnerable software. It can, however, reduce unnecessary access and help contain the consequences if a device is compromised.
Watch what leaves, not just what arrives
Security discussions often focus on stopping attackers getting in. Proxy misuse is also a reason to look at what goes out.
Your IT team or provider should have a proportionate way to review network activity and investigate departures from normal behaviour. A device contacting unfamiliar destinations or generating unexplained traffic deserves a closer look.
Useful evidence may include firewall logs, connection records and alerts from existing security tools. What’s available will depend on your equipment and setup.
Agree who receives alerts and what they’re expected to do. An alert nobody owns is simply an unread email with ambitions.
Keep monitoring proportionate, with appropriate access controls and retention arrangements. The aim is to spot and investigate problems, not collect everything indefinitely.
If something looks wrong, contain it properly
If you suspect a connected device is being misused, involve whoever manages your network. Where safe, isolate the suspected equipment and preserve available logs before making changes that could erase useful evidence.
Don’t casually disconnect systems responsible for alarms, access control or other essential functions. Coordinate with the relevant supplier and arrange a safe alternative where needed.
Recovery may involve updating, securely rebuilding or replacing the device, changing credentials and reviewing the access that allowed the problem. Simply restarting it isn’t evidence that it’s clean.
Make ownership the first control
You don’t need to memorise every malware name. You need to know what’s connected, who maintains it and how unusual activity gets investigated.
Start with an equipment inventory and a review of remote access. Those two conversations can reveal neglected devices and unnecessary exposure before they become an urgent interruption.
If you’d like to talk through your connected kit, its upkeep or the boundaries around it, speak to Morse Networks.
Let’s make IT one less thing to think about. morsenetworks.co.uk.