Key Takeaways
- A hidden backdoor named ENDLESSDOORS is embedded in the firmware of at least 21 Zbtlink router models, activating at every boot.
- The implant masquerades as a Linux kernel thread (kworker) but runs as a user‑land process with root privileges, contacting Chinese C2 servers every ~35 seconds.
- Communication uses a simple, unauthenticated protocol: the device sends a “hello” containing its LAN MAC address and then executes any command the server replies with, including spawning a live interactive root shell via the string rctlbash.
- No authentication or handshake is required, making the traffic easy to hijack by anyone who can intercept or spoof the DNS resolution for the C2 domains.
- Affected models span a wide range of Zbtlink products (e.g., CPE2801, WE1326, WG2107, Z8102AX-2DSIM) and all firmware images currently hosted on the vendor’s download page contain the malicious skworker init.d script.
- Zbtlink has temporarily removed the compromised firmware from its site and is working on patched images; users should inspect for specific files, block egress to the known C2 IPs/domains, and apply updates once available.
Overview of the Discovery
Cybersecurity firm VulnCheck disclosed a factory‑shipped backdoor dubbed ENDLESSDOORS that resides in the firmware of numerous Zbtlink routers. The backdoor was identified in all 21 firmware images available for download from Zbtlink’s website, covering a period of more than two years. According to the report, the implant starts automatically at boot via an init.d script named skworker and attempts to beacon to Chinese command‑and‑control (C2) infrastructure roughly every 35 seconds. The discovery highlights a supply‑chain compromise where malicious code is baked into the device before it reaches the end user, granting attackers persistent, privileged access without any user interaction.
Technical Architecture of ENDLESSDOORS
At its core, ENDLESSDOORS is a customized version of an open‑source tool called rctl (remote control linux), originally uploaded to GitHub in January 2015 and never updated. The rctl binary functions as a lightweight C2 client and server: the server listens on TCP port 7000, awaiting connections from clients that can then receive arbitrary shell commands or be instructed to open a reverse bash shell. In the compromised routers, the rctl client has been altered to disguise itself as a legitimate Linux kernel worker thread—appearing in process lists as kworker—while actually executing with root privileges in user space. This masquerade helps the implant evade casual inspection, as many administrators glance at kernel threads when troubleshooting performance issues.
Command‑and‑Control Mechanism
The implant’s communication protocol is deliberately minimalistic. Upon startup, the device sends a “hello” message to the C2 server that includes the router’s LAN MAC address. No handshake, encryption, or authentication follows; the server can immediately respond with any command it wishes the client to execute. Two specific commands are noteworthy: a generic instruction to “run this as root” and the reserved string rctlbash, which triggers the implant to open a second connection on port 7001, allocate a pseudo‑terminal, spawn /bin/sh, and bridge it to the attacker—effectively delivering a live interactive root shell. Because the traffic is plaintext and lacks any integrity checks, any entity capable of intercepting or spoofing the DNS resolution for the C2 domains can hijack the session and gain full control of the router.
Scope of Affected Devices
VulnCheck enumerated the exact models that contain the skworker init.d script and the associated rctl implant. All of the following Zbtlink routers are impacted: CPE2801, WE1026‑5G‑WD, WE1326, WE2007, WE2008‑DSIM, WE2416, WE3326, WE5927, WE5931, WE5931AC, WE826‑T3‑DSIM, WG108, WG1602, WG1608‑DSIM, WG209, WG2105, WG2107, WG259, WG3526, and Z8102AX‑2DSIM. Each of these devices contacts the same set of four primary and secondary endpoints:
- zbtctl.epplink.net (47.100.190.96)
- 47.107.224.89
- online-string.com (45.32.81.152)
- rbdg4nzqadui.wikaba.com (43.248.136.125)
The uniformity of the C2 addresses across all models suggests a centralized infrastructure managed by the threat actors who inserted the backdoor during the firmware build process.
Vendor Response and Mitigation Efforts
After VulnCheck’s findings went public, Zbtlink placed a notice on its firmware download page stating that security vulnerabilities had been detected in selected router firmware releases. As a precaution, the impacted firmware versions were temporarily withdrawn from distribution while the engineering team develops and validates secured, patched images. The notice promises immediate notification once the fixed firmware is ready for release. In the interim, Zbtlink advises customers to examine their routers for indicators of compromise—specifically looking for files such as /usr/sbin/kworker, /usr/lib/librctl.so, /etc/kworker.cfg, and the init.d script /etc/init.d/skworker—and to block outbound traffic to the known C2 IP addresses or domains at the network perimeter.
Recommendations for Users and Administrators
Given the severity of the ENDLESSDOORS backdoor, administrators should take several steps immediately. First, verify whether any of the listed Zbtlink models are in use and, if so, check the file system for the aforementioned artifacts. Second, implement egress filtering to prevent the router from reaching the C2 servers (47.100.190.96, 47.107.224.89, 45.32.81.152, 43.248.136.125) or the associated domain names. Third, consider disabling remote administration interfaces unless absolutely necessary, and restrict LAN‑side access to trusted devices only. Fourth, monitor system logs and process lists for any unexplained kworker instances running with root privileges. Finally, await the official patched firmware from Zbtlink and apply it as soon as it becomes available; until then, treat the affected routers as potentially compromised and isolate them from critical network segments.
By combining diligent host‑based inspection with network‑level blocking and timely patching, organizations can mitigate the risk posed by this factory‑implanted backdoor and reduce the likelihood of persistent, privileged access by attackers.