{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/router-firmware/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-66747"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Router Firmware"],"_cs_severities":["critical"],"_cs_tags":["supply-chain","firmware","backdoors","remote-access-trojan","network-security"],"_cs_type":"advisory","_cs_vendors":["Zbtlink"],"content_html":"\u003cp\u003eZbtlink router firmware across its entire product line contains an embedded remote-control implant identified as ENDLESSDOORS. This implant is derived from the open-source tool 'rctl' and is integrated as a persistent OpenWrt package (librctl.so). The malware masquerades as a legitimate system process, running as root under the name 'kworker' to mimic kernel worker threads and evade detection by basic process monitors.\u003c/p\u003e\n\u003cp\u003eThe implant operates via an unauthenticated, cleartext command-and-control (C2) channel that initiates an outbound callback approximately every 35 seconds. It does not open a listening port, opting instead for a phone-home architecture that uses hardcoded C2 communication parameters for both command handling (port 7000) and interactive shell sessions (port 7001). Because the communication lacks both authentication and transport encryption, any third party capable of intercepting the network path or hijacking the C2 domain can gain full root-level remote code execution on the affected devices by issuing commands via popen() or the specific 'rctlbash' command.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe ENDLESSDOORS implant, bundled as 'librctl.so', is initialized automatically at system boot via firmware-level configuration.\u003c/li\u003e\n\u003cli\u003eThe process is spawned with root privileges and renamed to 'kworker' to obfuscate its presence among legitimate kernel threads.\u003c/li\u003e\n\u003cli\u003eThe implant periodically polls for C2 instructions by initiating outbound cleartext TCP connections on ports 7000 and 7001 every 35 seconds.\u003c/li\u003e\n\u003cli\u003eAn attacker intercepts the cleartext outbound traffic or redirects DNS queries to a malicious server mimicking the hardcoded C2 infrastructure.\u003c/li\u003e\n\u003cli\u003eThe attacker sends a command string to the implant over the unauthenticated TCP stream.\u003c/li\u003e\n\u003cli\u003eThe implant's command handler processes the received string using popen() with root (uid=0) permissions.\u003c/li\u003e\n\u003cli\u003eThe attacker issues the 'rctlbash' command to spawn a reverse interactive root shell to the attacker's machine.\u003c/li\u003e\n\u003cli\u003eFull persistent remote administrative control is achieved on the router, facilitating further network lateral movement.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability affects all Zbtlink router firmware builds currently in deployment. Successful exploitation allows an attacker to achieve unauthenticated remote code execution with root privileges. Given the nature of these devices acting as network gateways, this impact enables total traffic interception, credential harvesting, and long-term persistence within the affected local networks.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eMonitor egress traffic from network hardware for cleartext TCP connections on ports 7000 and 7001.\u003c/li\u003e\n\u003cli\u003eIdentify and isolate Zbtlink routers within the network, as they are inherently compromised by firmware design.\u003c/li\u003e\n\u003cli\u003eImplement strict firewall egress rules at the network perimeter to block all communication to unrecognized or non-essential external IP addresses from router management interfaces.\u003c/li\u003e\n\u003cli\u003eAudit process lists on managed OpenWrt devices for any 'kworker' instances that exhibit unexpected socket connections or that do not correlate with kernel-level thread activity.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-05T13:16:19Z","date_published":"2026-08-05T13:16:19Z","id":"https://feed.craftedsignal.io/briefs/2026-08-zbtlink-endlessdoors-implant/","summary":"Zbtlink router firmware ships with the ENDLESSDOORS remote-control implant, which runs as root, masquerades as a kernel process, and enables unauthenticated remote command execution.","title":"Zbtlink Router Firmware Contains Embedded ENDLESSDOORS Implant","url":"https://feed.craftedsignal.io/briefs/2026-08-zbtlink-endlessdoors-implant/"}],"language":"en","title":"CraftedSignal Threat Feed - Router Firmware","version":"https://jsonfeed.org/version/1.1"}