Chinese Routers Ship With Backdoor That Calls Home Every 35 Seconds

Security researchers have uncovered a factory-installed backdoor embedded in at least 20 router models manufactured by Chinese firm Zbtlink, according to a new disclosure from VulnCheck. The malicious code appears in all 21 firmware images currently offered by Zbtlink spanning more than two years. The backdoors activate on their own and try to contact Chinese command-and-control servers as frequently as every 35 seconds, disguising themselves as Linux kernel threads while actually running as userland processes with root privileges.

The implants, which VulnCheck has named ENDLESSDOORS, are built around a small utility called rctl that was uploaded to GitHub in January 2015 and never updated since. The server waits on port 7000 for clients to connect and can either send individual shell commands or instruct the client to open a reverse bash shell. The backdoor requires no handshake, negotiation, or authentication—once it transmits a "hello" message along with the LAN MAC address, it will execute whatever the server returns. A single reserved command, "rctlbash," instructs the implant to open a second connection on port 7001, create a pseudo-terminal, launch /bin/sh, and bridge it together. Every firmware listed on Zbtlink's download page contains the rctl implant and launches it at startup through an init.d script called "skworker." The affected models include CPE2801, WE1026-5G-WD, WE1326, WE2007, WE2008-DSIM, WE2416, WE3326, WE5927, WE5931, WE5931AC, WE826-T3-DSIM, WG108, WG1602, WG1608-DSIM, WG209, WG2105, WG2107, WG259, WG3526, and Z8102AX-2DSIM. Each model has been observed dialing four primary and secondary endpoints: zbtctl.epplink[.]net, 47.107.224[.]89, online-string[.]com, and rbdg4nzqadui.wikaba[.]com.

"The vocabulary of this protocol is two phrases: run this as root, and give me a root shell," Jacob Baines, VulnCheck's Chief Technology Officer, said. "Anyone along the network path can hijack the client/server communication. Anyone who controls the resolution of rbdg4nzqadui.wikaba[.]com, or the address it resolves to, can control any ENDLESSDOORS implant that tries to phone home." An attacker can exploit this weakness to intercept the outbound rctl communications and gain a live root shell, seizing control of the router without needing to reach it from the internet. Zbtlink has temporarily removed the affected firmware versions from its download channels and posted a message stating that its engineering team is working to create and validate patched firmware. A spokesperson told The Hacker News that the feature is "solely intended" for after-sales maintenance and is generally kept only on sample units to help customers with software debugging.

The VulnCheck report explains that the backdoor's lack of authentication makes it especially dangerous because any party who can intercept the traffic or take over the domain resolution can commandeer all affected devices. The protocol's simplicity—accepting commands without verification and executing them with root access—means an adversary doesn't need sophisticated tools or zero-day exploits to compromise thousands of routers simultaneously. Zbtlink's spokesperson noted that the company specializes in OEM and ODM customization services, and that customers typically use their own software rather than ZBT's default firmware. In the meantime, VulnCheck advises customers to examine the process list, scan the file system for files like /usr/sbin/kworker, /usr/lib/librctl.so, /etc/kworker.cfg, and /etc/init.d/skworker, and block the egress endpoints to prevent the backdoor from phoning home. The combination of widespread deployment, automatic activation, and trivial exploitation makes ENDLESSDOORS a significant supply-chain risk for any organization using these routers in production environments. Supply-chain compromises at the firmware level represent a challenge that extends well beyond technical patching, forcing enterprises to reconsider vendor trust and hardware procurement policies. Organizations that rely on white-label networking equipment may face difficult choices between cost efficiency and the transparency needed to verify clean code before deployment.