ENDLESSDOORS: The Factory-Ship Backdoor in Zbtlink Routers
ENDLESSDOORS is a backdoor implant found in Zbtlink router firmware. It is based on the rctl tool and allows unauthenticated remote attackers…
Tag: backdoor
rctl: The Open-Source Tool Behind ENDLESSDOORS
rctl (remote control linux) is a simple command and control client/server tool uploaded to GitHub in 2015. It listens on port 7000…
Zbtlink AX3000: Router Model Analyzed for ENDLESSDOORS
The Zbtlink AX3000 is a router model that was analyzed by VulnCheck and found to contain the ENDLESSDOORS backdoor. It runs a…
QuickFox Supply Chain Attack Delivers FDMTP Backdoor via Trojanized Windows Installer
Fortinet FortiGuard Labs has disclosed a long-standing supply chain attack targeting QuickFox, a VPN and network acceleration tool popular among overseas Chinese…
FDMTP Backdoor: Capabilities and Distribution
FDMTP is a backdoor first highlighted by Trend Micro in September 2024, distributed via the PUBLOAD downloader. It establishes C2 communication, gathers…
Wukong Application Targeted for Malicious Code Injection
The backdoor used in the Alibaba supply chain attack targets Wukong, an enterprise collaboration application, by injecting malicious code to achieve persistence…
Qoder Application Targeted for Malicious Code Injection
The backdoor used in the Alibaba supply chain attack targets Qoder, an enterprise collaboration application, by injecting malicious code to maintain persistence…
18 Malicious npm Packages Deliver Cross-Platform RAT to Alibaba Tool Users
Cybersecurity researchers have uncovered a sophisticated software supply chain attack targeting users of Alibaba developer tools with a cross-platform remote access trojan…
Complex Backdoor with Lateral Movement Capabilities
The final-stage payload is a complex backdoor equipped with comprehensive command execution, arbitrary file upload/download, host reconnaissance, payload staging, and lateral movement…
DingTalk Targeted for Persistence
The final-stage backdoor in the Alibaba supply chain attack injects malicious code into DingTalk, a popular enterprise collaboration app, to maintain persistence…