Interesting analysis by Fortinet in their ClingSTUN Linux Backdoor writeup. There's a related blog post by @eFeSpain called Twelve alibis and a mailbox that concludes that only one of the STUN servers that the malware connects to is controlled by the threat actors, the other ones are just decoys. The server believed to belong to the threat actors is 145.249.115.184. That blog post also indicates that this activity seems to be related to the #ngioweb botnet and #NSOCKS service that Lumen reported on last year.