{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/vendors/zbtlink/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["CPE2801 Firmware","WE1026-5G-WD Firmware","WE1326 Firmware","WE2007 Firmware","WE2008-DSIM Firmware","WE2416 Firmware","WE3326 Firmware","WE5927 Firmware","WE5931 Firmware","WE5931AC Firmware","WE826-T3-DSIM Firmware","WG108 Firmware","WG1602 Firmware","WG1608-DSIM Firmware","WG209 Firmware","WG2105 Firmware","WG2107 Firmware","WG259 Firmware","WG3526 Firmware","ZBT-Z8102AX-2SIM Firmware"],"_cs_severities":["high"],"_cs_tags":["firmware-vulnerability","implant","router","network-security","informational"],"_cs_type":"advisory","_cs_vendors":["Zbtlink"],"content_html":"\u003cp\u003eResearchers have identified a significant security vulnerability in a wide range of Zbtlink wireless router firmware, collectively referred to as the ENDLESSDOORS threat. Attackers are exploiting this vulnerability to deploy a root-level implant, identified as 'rctl' or 'kworker'. The 'rctl' utility is a remote Linux control tool that provides attackers with persistent, unauthorized administrative access to the underlying operating system of the networking hardware. By establishing a phone-home communication mechanism, the implant enables remote command execution and exfiltration of sensitive network traffic. Given the wide array of affected firmware versions and models, this vulnerability represents a severe risk of long-term network compromise for organizations utilizing Zbtlink hardware. Defenders should review device configurations and monitor for unauthorized binary execution within the router's management interfaces or internal shell.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of the ENDLESSDOORS vulnerability allows for complete system compromise of the affected Zbtlink routers. This grants attackers the ability to intercept internal network traffic, manipulate DNS settings, gain persistent access to private segments of the network, and utilize the devices as part of a botnet. The wide scope of affected legacy and modern firmware versions impacts various small office and industrial networking deployments.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eIdentify all Zbtlink router models listed in this brief and isolate them from public-facing internet segments immediately.\u003c/li\u003e\n\u003cli\u003eAudit all administrative logs on networking equipment for the execution of unexpected binaries, specifically processes labeled 'rctl' or 'kworker'.\u003c/li\u003e\n\u003cli\u003eVerify firmware versions against the manufacturer's security download page and update to the latest provided images.\u003c/li\u003e\n\u003cli\u003eRestrict administrative access to router interfaces to known, trusted internal management IP ranges.\u003c/li\u003e\n\u003cli\u003eImplement outbound traffic filtering at the network perimeter to block unauthorized 'phone-home' or C2 traffic originating from infrastructure networking devices.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-05T21:23:04Z","date_published":"2026-08-05T21:23:04Z","id":"https://feed.craftedsignal.io/briefs/2026-08-zbtlink-rctl-implant/","summary":"Multiple Zbtlink router models are susceptible to the ENDLESSDOORS root implant, which leverages the rctl remote control tool for unauthorized access and persistent phone-home capabilities.","title":"ENDLESSDOORS Vulnerability Affecting Zbtlink Routers","url":"https://feed.craftedsignal.io/briefs/2026-08-zbtlink-rctl-implant/"},{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":9.8,"id":"CVE-2026-66747"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Router Firmware"],"_cs_severities":["critical"],"_cs_tags":["supply-chain","firmware","backdoors","remote-access-trojan","network-security"],"_cs_type":"advisory","_cs_vendors":["Zbtlink"],"content_html":"\u003cp\u003eZbtlink router firmware across its entire product line contains an embedded remote-control implant identified as ENDLESSDOORS. This implant is derived from the open-source tool 'rctl' and is integrated as a persistent OpenWrt package (librctl.so). The malware masquerades as a legitimate system process, running as root under the name 'kworker' to mimic kernel worker threads and evade detection by basic process monitors.\u003c/p\u003e\n\u003cp\u003eThe implant operates via an unauthenticated, cleartext command-and-control (C2) channel that initiates an outbound callback approximately every 35 seconds. It does not open a listening port, opting instead for a phone-home architecture that uses hardcoded C2 communication parameters for both command handling (port 7000) and interactive shell sessions (port 7001). Because the communication lacks both authentication and transport encryption, any third party capable of intercepting the network path or hijacking the C2 domain can gain full root-level remote code execution on the affected devices by issuing commands via popen() or the specific 'rctlbash' command.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe ENDLESSDOORS implant, bundled as 'librctl.so', is initialized automatically at system boot via firmware-level configuration.\u003c/li\u003e\n\u003cli\u003eThe process is spawned with root privileges and renamed to 'kworker' to obfuscate its presence among legitimate kernel threads.\u003c/li\u003e\n\u003cli\u003eThe implant periodically polls for C2 instructions by initiating outbound cleartext TCP connections on ports 7000 and 7001 every 35 seconds.\u003c/li\u003e\n\u003cli\u003eAn attacker intercepts the cleartext outbound traffic or redirects DNS queries to a malicious server mimicking the hardcoded C2 infrastructure.\u003c/li\u003e\n\u003cli\u003eThe attacker sends a command string to the implant over the unauthenticated TCP stream.\u003c/li\u003e\n\u003cli\u003eThe implant's command handler processes the received string using popen() with root (uid=0) permissions.\u003c/li\u003e\n\u003cli\u003eThe attacker issues the 'rctlbash' command to spawn a reverse interactive root shell to the attacker's machine.\u003c/li\u003e\n\u003cli\u003eFull persistent remote administrative control is achieved on the router, facilitating further network lateral movement.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability affects all Zbtlink router firmware builds currently in deployment. Successful exploitation allows an attacker to achieve unauthenticated remote code execution with root privileges. Given the nature of these devices acting as network gateways, this impact enables total traffic interception, credential harvesting, and long-term persistence within the affected local networks.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eMonitor egress traffic from network hardware for cleartext TCP connections on ports 7000 and 7001.\u003c/li\u003e\n\u003cli\u003eIdentify and isolate Zbtlink routers within the network, as they are inherently compromised by firmware design.\u003c/li\u003e\n\u003cli\u003eImplement strict firewall egress rules at the network perimeter to block all communication to unrecognized or non-essential external IP addresses from router management interfaces.\u003c/li\u003e\n\u003cli\u003eAudit process lists on managed OpenWrt devices for any 'kworker' instances that exhibit unexpected socket connections or that do not correlate with kernel-level thread activity.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-05T13:16:19Z","date_published":"2026-08-05T13:16:19Z","id":"https://feed.craftedsignal.io/briefs/2026-08-zbtlink-endlessdoors-implant/","summary":"Zbtlink router firmware ships with the ENDLESSDOORS remote-control implant, which runs as root, masquerades as a kernel process, and enables unauthenticated remote command execution.","title":"Zbtlink Router Firmware Contains Embedded ENDLESSDOORS Implant","url":"https://feed.craftedsignal.io/briefs/2026-08-zbtlink-endlessdoors-implant/"}],"language":"en","title":"CraftedSignal Threat Feed - Zbtlink","version":"https://jsonfeed.org/version/1.1"}