Cybersecurity firm VulnCheck has disclosed a factory-installed backdoor present in all 21 firmware images currently available for Zbtlink routers, spanning over two years of releases and at least 20 distinct models. The implant, which VulnCheck named ENDLESSDOORS, starts automatically on boot and beacons to Chinese command-and-control (C2) infrastructure as frequently as every 35 seconds. It disguises itself as a Linux kernel thread named kworker but is actually a userland process running with full root privileges. The underlying code, called rctl (remote control linux), was uploaded to GitHub in January 2015 and has never been updated — it is a stripped-down C2 client whose only job is to receive and execute commands from a remote server.
The protocol has no authentication whatsoever. When the implant sends a “hello” packet alongside the router’s LAN MAC address, the server can respond with arbitrary shell commands or trigger a full interactive root shell over a second connection. Anyone who controls the domain rbdg4nzqadui.wikaba[.]com or the IP address 47.107.224[.]89 — or who can intercept traffic between the router and those endpoints — can silently take over the device with root access. VulnCheck notes that because there is no handshake or negotiation, anyone along the network path can hijack the session, not just the intended C2 operator.
How to check if you’re affected
Affected models include the Zbtlink AX3000 and any other Zbtlink router for which firmware is available from the manufacturer. All 21 current Zbtlink firmware images examined by VulnCheck contained the backdoor. If you have a Zbtlink router on your network, treat it as compromised. Until the manufacturer issues clean firmware, isolate the device from sensitive systems and consider replacing it with a product from a vendor that publishes verifiable build artifacts and an open-source firmware option.