Zbtlink Routers Ship With Factory Backdoor Exposing Root Shells

Cybersecurity researchers at VulnCheck have uncovered a factory-implanted backdoor, codenamed ENDLESSDOORS, embedded in at least 20 Zbtlink router models distributed globally. The malicious implant, named after the obscure open-source tool rctl (remote control Linux) uploaded to GitHub in January 2015, appears in all 21 firmware images currently hosted on zbtlink.com, spanning more than two years of releases. The backdoor masquerades as a legitimate Linux kernel thread named "skworker," allowing it to blend in with authentic kworker processes while operating as a root-level userland application that beacons to Chinese command-and-control infrastructure as often as every 35 seconds.

Once a Zbtlink device boots, an init.d script named "skworker" automatically launches the ENDLESSDOORS implant, which then attempts to resolve and contact four primary and secondary endpoints, including zbtctl.epplink[.]net, rbdg4nzqadui.wikaba[.]com, and online-string[.]com. Critically, the implant performs no handshake, negotiation, or authentication. It simply transmits a "hello" message containing the device's LAN MAC address to the waiting C2 server on port 7000. Any response from the server is executed as root on the compromised device. A reserved string, "rctlbash," triggers the implant to open a secondary connection on port 7001, allocate a pseudo-terminal, spawn /bin/sh, and bridge it back to the attacker, delivering a fully interactive unauthenticated root shell. Network defenders can verify exposure of these ports using a port scanner, while the suspicious domains can be investigated with a WHOIS lookup.

The list of affected models is extensive and includes consumer and industrial devices such as the CPE2801, WE1026-5G-WD, WE1326, WE2007, WE2008-DSIM, WE2416, WE3326, WE5927, WE5931, WE5931AC, WE826-T3-DSIM, WG108, WG1602, WG1608-DSIM, WG209, WG2105, WG2107, WG259, WG3526, and Z8102AX-2DSIM. Each model dials the same set of C2 endpoints, and because the protocol lacks any encryption or authentication, anyone with access to the network path between the router and the C2 server can hijack the communication. Attackers who control the DNS resolution of rbdg4nzqadui.wikaba[.]com or the IP addresses it resolves to can take over any ENDLESSDOORS implant attempting to phone home, all without requiring inbound internet reachability to the victim device.

VulnCheck CTO Jacob Baines emphasized that the threat model is unusually broad: "The vocabulary of this protocol is two phrases: run this as root, and give me a root shell." Organizations and individuals using any of the affected Zbtlink router models are strongly advised to discontinue use, replace the devices with hardware from vendors offering verifiable supply-chain integrity, and monitor their networks for anomalous outbound traffic to the listed C2 endpoints. Network administrators should also run a DNS leak test to ensure rogue DNS resolutions are not silently redirecting implant traffic to attacker-controlled infrastructure.