Chinese-Made Zbtlink Routers Ship With Backdoor That Opens Unauthenticated Root Shells

Cybersecurity researchers have disclosed details of a factory-shipped backdoor implanted in at least 20 Chinese router models from Zbtlink. According to a report from VulnCheck, the implant appears in all 21 firmware images currently available from Zbtlink, spanning more than two years. The backdoors start automatically and attempt to beacon to Chinese command-and-control (C2) infrastructure as often as every 35 seconds. They masquerade as Linux kernel threads but are actually userland processes running with root privileges, blending with legitimate kworker processes.

The implants, codenamed ENDLESSDOORS, are based on a small tool called rctl (remote control linux), uploaded to GitHub on January 14, 2015. The server listens on port 7000 for client connections and can send individual shell commands or spawn a reverse bash shell. The version analyzed on the Zbtlink AX3000 is configured to contact 47.107.224[.]89 and rbdg4nzqadui[.]wikaba[.]com.

There is no handshake, negotiation, or authentication. Once the implant sends a hello message with the LAN MAC address, it runs whatever the server sends back. A reserved string, rctlbash, opens a second connection to port 7001, allocates a pseudo-terminal, spawns /bin/sh, and bridges it—providing a live interactive root shell. Anyone along the network path can hijack the client/server communication, and anyone controlling the DNS resolution of the C2 domains can control any ENDLESSDOORS implant.

VulnCheck noted that every firmware listed on zbtlink.com’s download page embeds the rctl implant and starts it at boot with an init.d script named skworker. Affected models include CPE2801, WE1026-5G-WD, WE1326, WE2007, WE2008-DSIM, WE2416, WE3326, WE5927, WE5931, WE5931AC, WE826-T3-DSIM, WG108, WG1602, WG1608-DSIM, WG209, WG2105, WG2107, WG259, WG3526, and Z8102AX-2DSIM. These models dial the same set of four primary and secondary endpoints: zbtctl.epplink[.]net (47.100.190[.]96), 47.107.224[.]89, online-string[.]com (45.32.81[.]152), and rbdg4nzqadui.wikaba[.]com (43.248.136[.]125).

Zbtlink has temporarily taken down the impacted firmware versions from its download page and is working on patched firmware. Customers are advised to check for files like /usr/sbin/kworker, /usr/lib/librctl.so, /etc/kworker.cfg, and /etc/init.d/skworker, and to block the egress points.