Latest Threats

linking threat corpus_

ENDLESSDOORS: Zbtlink Router Firmware Contains rctl Backdoor (CVE-2026-66747) Across 20+ Models — Threadlinqs Intelligence

As of 2026-08-09, ENDLESSDOORS: Zbtlink Router Firmware Contains rctl Backdoor (CVE-2026-66747) Across 20+ Models is a critical-severity supply chain threat attributed to Shenzhen Zhibotong Electronics (China), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 28 indicators of compromise.

Threat ID: TL-2026-1906 · Severity: CRITICAL · CVSS: 9.8 · Status: ACTIVE · Category: SUPPLY_CHAIN

Updated: 2026-08-09 · 3 updates · revalidated 3× · latest source

Attribution: Shenzhen Zhibotong Electronics · China · UNKNOWN

VulnCheck researcher Jacob Baines discovered that Zbtlink router firmware ships a persistent remote-access implant called ENDLESSDOORS (rctl/remote-control-linux) across 20+ router models. The

On August 5, 2026, VulnCheck zero-day research team disclosed CVE-2026-66747 (CVSS 9.8 CRITICAL), a deliberate root-level backdoor embedded in firmware for over 20 Zbtlink router models. The implant, designated ENDLESSDOORS by VulnCheck, is a customized build of the open-source ycsunjane/rctl tool ("remote control linux") — a C-based client-server framework uploaded to GitHub on January 14, 2015 and never subsequently updated. The backdoor binary runs as /usr/sbin/kworker, a userland process deliberately named to masquerade as a Linux kernel thread. Legitimate kernel kworkers appear in ps output within brackets ([kworker/0:0H-kb]) and have zero VSZ; the implant runs as an unbracketed kworker with a real memory footprint. Two kworker processes run on each infected device. Persistence is achieved via /etc/init.d/skworker, an init.d boot script embedded in the firmware. Supporting files include /usr/lib/librctl.so (the rctl shared library compiled as an OpenWrt package), /etc/kworker.cfg (configuration), and a certificate path /etc/ssl/certs/wirelesser_ca.crt referenced in the binary. Communication is over unencrypted cleartext TCP. The implant initiates outbound connections to hardcoded C2 servers on port 7000 (command channel) and port 7001 (interactive reverse shell). Outbound connections bypass NAT and firewall ingress rules since the device dials out. On each connection, the implant sends a fixed 39-byte payload: a 33-byte device class label padded with nulls, followed by the device's LAN MAC address. There is no handshake, key exchange, or authentication on the channel. The implant reconnects approximately every 35 seconds if the C2 is unreachable. The C2 protocol supports exactly two operations. Any data received from the server is passed directly to popen() and executed as uid 0 (root) — arbitrary shell command execution. The reserved string "rctlbash" triggers a second connection to port 7001, where the implant allocates a pseudo-terminal, spawns /bin/sh, and bridges the TCP socket to it, granting an interactive root shell. There is no allow-list, sandbox, or verification mechanism on either operation. Four C2 endpoints were identified by VulnCheck across the affected product line. The primary endpoint zbtctl.epplink.net (47.100.190.96) is hosted on Alibaba Cloud in Shanghai and is the only C2 domain connected to Zbtlink by registration. A hardcoded backup IP 47.107.224.89 is hosted on Alibaba Cloud in Shenzhen. Two additional secondary endpoints were identified: online-string.com (45.32.81.152, Vultr Holdings) and the DDNS domain rbdg4nzqadui.wikaba.com (43.248.136.125, Jiangsu Dongyun Cloud). The AX3000 model tested used the wikaba.com DDNS endpoint, which the researchers described as "sort of ideal for non-attribution"; all but two other models used the more overt zbtctl.epplink.net. The confirmed affected models span both MIPS and aarch64 (ARM) architectures: CPE2801, WE1026-5G-WD, WE1326, WE2007, WE2008-DSIM, WE2416, WE3326, WE5927, WE5931, WE5931AC, WE826-T3-DSIM, WG108, WG1602, WG1608-DSIM, WG209, WG2105, WG2107, WG259, WG3526, and ZBT-Z8102AX-2SIM. Firmware versions span from v20.09.30 (WE3326, earliest confirmed at approximately 2020) through v23.10.11 (WG1602, approximately late 2023). Some models share identical kworker binary hashes, indicating the same compiled binary was reused across multiple firmware images; the Z8102AX used a distinct hash (31ee58a1...). Zbtlink offers OEM/ODM services, meaning devices branded as Wiflyer, ZBTWiFi, or sold under other white-label names with matching model numbers are equally affected. Because the channel is unauthenticated and unencrypted, control is not limited to the implant's original operator. Any party that answers at the C2 address, occupies the network path (DNS or route hijack), or acquires the hardcoded C2 domain can gain unauthenticated root-level remote code execution. VulnCheck built a PoC exploit using their go-exploit framework and demonstrated an inte

MITRE ATT&CK Techniques

T1543 Create or Modify System Process; T1036 Masquerading; T1059 Command and Scripting Interpreter; T1095 Non-Application Layer Protocol; T1008 Fallback Channels; T1572 Protocol Tunneling; T1205 Traffic Signaling; T1082 System Information Discovery; T1588 Obtain Capabilities; T1583.001 Acquire Infrastructure: Domains; T1583.004 Acquire Infrastructure: Server; T1608.001 Stage Capabilities: Upload Malware; T1475 Deliver Malicious App via Authorized App Store; T1199 Trusted Relationship; T1059.004 Command and Scripting Interpreter: Unix Shell; T1543.004 Launch Daemon; T1036.005 Match Legitimate Resource Name or Location; T1027 Obfuscated Files or Information; T1571 Non-Standard Port; T1219 Remote Access Tools; T1105 Ingress Tool Transfer; T1041 Exfiltration Over C2 Channel; T1195.003 Supply Chain Compromise: Compromise Hardware Supply Chain; T1583.003 Acquire Infrastructure: Virtual Private Server; T1037.004 Boot or Logon Initialization Scripts: RC Scripts; T1016 System Network Configuration Discovery; T1557 Adversary-in-the-Middle

Associated CVEs

CVE-2026-66747

Weaknesses (CWE)

CWE-506, CWE-306

Target sectors: telecoms, small-business, consumer-iot, hospitality, education

Target regions: Global, North America, Europe, Asia-Pacific

Update History

2026-08-09: What changed No field escalation. The report proposes exploitability ACTIVE→POC_PUBLIC, attribution_confidence HIGH→LOW, threat_actor Shenzhen Zhibotong Electronics→Unknown, and nation_state China→"China (suspected, unconfirmed)" — all of t
2026-08-09 — Zbtlink Routers Ship With Factory-Installed ENDLESSDOORS Root Backdoor (CVE-2026-66747): What changed No escalation to core fields (severity, exploitability, CVSS, status all unchanged at CRITICAL/ACTIVE/9.8/ACTIVE). The newer report adds corroborating third-party analysis (CSA), a follow-up vendor statement, a KEV-absence conf
2026-08-06 — Chinese-Made ZBTlink Routers Ship with Factory-Embedded ENDLESSDOORS Backdoor (CVE-2026-66747): What changed No change to severity (CRITICAL), exploitability (ACTIVE), status (ACTIVE), or CVSS (9.8) — all match the existing record. The new report's attribution_confidence (MEDIUM, generic 'state-aligned Chinese actors suspected') is va

References

Detections & IOCs

As of 2026-08-15, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 28 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.

SUPPLY_CHAIN, CRITICAL, threat intelligence, cybersecurity, CVE-2026-66747, T1543, T1036, T1059, T1095, T1008, T1572, T1205, T1082, T1588, T1583.001

Threadlinqs Intelligence — Real-Time Threat Detection Platform

Latest Threats

🔄 Threat Comparison