Malware

rctl

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

15 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

3 techniques

T1059Command and Scripting InterpreterEvidence2

One reserved string, rctlbash, tells the implant to open a second connection to port 7001, allocate a pseudo-terminal, spawn /bin/sh, and bridge it," Baines explained. "That is a live interactive root shell." | The server listens on port 7000 for clients to connect. It can send the client individual shell commands or tell the client to spawn a reverse bash shell.

T1059.004Unix ShellEvidence6

...может отправлять клиенту отдельные шелл-команды или запускать реверс-шелл... строка rctlbash может вынудить бэкдор открыть второе соединение на порту 7001, запустить /bin/sh и предоставить удаленным операторам интерактивный root-шелл. | ...может отправлять клиенту отдельные шелл-команды... затем просто выполняет полученные в ответ команды.

T1574Hijack Execution FlowEvidence1

Anyone along the network path can hijack the client/server communication. Anyone who controls the resolution of rbdg4nzqadui[.]wikaba[.]com, or the address it resolves to, can control any ENDLESSDOORS implant that tries to phone home.

Persistence

3 techniques

T1037Boot or Logon Initialization ScriptsEvidence5

...имплант, который запускается посредством init.d-скрипта skworker...

T1546Event Triggered ExecutionEvidence2

VulnCheck researchers found a backdoor baked into Zbtlink routers... Two processes named “kworker” were running as root... The researchers pointed out that twenty different router models carry the same backdoor, all of them starting it automatically at boot through an init script named skworker.

T1547Boot or Logon Autostart ExecutionEvidence1

It is the open-source ycsunjane/rctl tool built in as an OpenWrt package (librctl.so), started at boot and run as root under the process name kworker to blend in with the kernel's [kworker/*] threads.

Privilege Escalation

3 techniques

T1037Boot or Logon Initialization ScriptsEvidence5

...имплант, который запускается посредством init.d-скрипта skworker...

T1546Event Triggered ExecutionEvidence2

T1547Boot or Logon Autostart ExecutionEvidence1

Stealth

2 techniques

T1036MasqueradingEvidence4

They masquerade as a Linux kernel thread, but are actually userland processes running with root privileges while blending their true functionality with other legitimate kworker processes.

T1574Hijack Execution FlowEvidence1

Discovery

1 technique

T1082System Information DiscoveryEvidence1

When the implant reaches a server, it sends a fixed 39-byte hello: a 33-byte class label padded with nulls, then its LAN MAC address.

Lateral Movement

3 techniques

T1021Remote ServicesEvidence1

rctl 用于远程管理海量linux设备。目前功能: ... 支持远程shell登录

T1021.005VNCEvidence1

One reserved string, rctlbash, tells the implant to open a second connection to port 7001, allocate a pseudo-terminal, spawn /bin/sh, and bridge it. That is a live interactive root shell.

T1210Exploitation of Remote ServicesEvidence1

By exploiting this persistent connection, an attacker could potentially take control of the router, bypassing standard authentication measures.

Command and Control

4 techniques

T1071Application Layer ProtocolEvidence8

The implant phones home to a hardcoded server... When the implant reaches a server, it sends a fixed 39-byte hello... After that, anything the server sends is handed to popen() and executed as uid 0.

T1090.001Internal ProxyEvidence1

由客户端发起链接,解决路由问题

T1219Remote Access ToolsEvidence2

On affected routers, the suspicious process is not a normal system thread: it runs as root, has its own memory use, and connects outward as a customized version of the old remote-control utility rctl.

T1573Encrypted ChannelEvidence1

证书认证ssl加密数据传输

INDICATORS OF COMPROMISE

IOCs tracked for this family

5 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

5 tracked

IPs, domains, and DNS infrastructure linked to this family.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in apptoday

ip.v4●●●●●●●●●●●●View more in apptoday

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

xakepNews

Aug 7, 2026

В роутерах Zbtlink нашли бэкдор. Производитель утверждает, что это инструмент сервисного обслуживания - Хакер

Open-source remote control tool forming the basis of ENDLESSDOORS. Its server listens on port 7000 and can send shell commands or trigger a reverse shell, with no authentication or key exchange described in the report.

vulncheck blogNews

Aug 5, 2026

ENDLESSDOORS Is Phoning Home. Pick Up. | Blog | VulnCheck

A simple command-and-control client/server tool that listens on port 7000, can execute shell commands, and can instruct clients to spawn a reverse bash shell. The ENDLESSDOORS implant is described as a customized version of rctl.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching5

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping15

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

rctl

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

15 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

3 techniques

T1059Command and Scripting InterpreterEvidence2

T1059.004Unix ShellEvidence6

T1574Hijack Execution FlowEvidence1

Persistence

3 techniques

T1037Boot or Logon Initialization ScriptsEvidence5

...имплант, который запускается посредством init.d-скрипта skworker...

T1546Event Triggered ExecutionEvidence2

T1547Boot or Logon Autostart ExecutionEvidence1

Privilege Escalation

3 techniques

T1037Boot or Logon Initialization ScriptsEvidence5

...имплант, который запускается посредством init.d-скрипта skworker...

T1546Event Triggered ExecutionEvidence2

T1547Boot or Logon Autostart ExecutionEvidence1

Stealth

2 techniques

T1036MasqueradingEvidence4

They masquerade as a Linux kernel thread, but are actually userland processes running with root privileges while blending their true functionality with other legitimate kworker processes.

T1574Hijack Execution FlowEvidence1

Discovery

1 technique

T1082System Information DiscoveryEvidence1

When the implant reaches a server, it sends a fixed 39-byte hello: a 33-byte class label padded with nulls, then its LAN MAC address.

Lateral Movement

3 techniques

T1021Remote ServicesEvidence1

rctl 用于远程管理海量linux设备。目前功能: ... 支持远程shell登录

T1021.005VNCEvidence1

One reserved string, rctlbash, tells the implant to open a second connection to port 7001, allocate a pseudo-terminal, spawn /bin/sh, and bridge it. That is a live interactive root shell.

T1210Exploitation of Remote ServicesEvidence1

By exploiting this persistent connection, an attacker could potentially take control of the router, bypassing standard authentication measures.

Command and Control

4 techniques

T1071Application Layer ProtocolEvidence8

The implant phones home to a hardcoded server... When the implant reaches a server, it sends a fixed 39-byte hello... After that, anything the server sends is handed to popen() and executed as uid 0.

T1090.001Internal ProxyEvidence1

由客户端发起链接,解决路由问题

T1219Remote Access ToolsEvidence2

T1573Encrypted ChannelEvidence1

证书认证ssl加密数据传输

INDICATORS OF COMPROMISE

IOCs tracked for this family

5 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

5 tracked

IPs, domains, and DNS infrastructure linked to this family.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in apptoday

ip.v4●●●●●●●●●●●●View more in apptoday

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

xakepNews

Aug 7, 2026

В роутерах Zbtlink нашли бэкдор. Производитель утверждает, что это инструмент сервисного обслуживания - Хакер

vulncheck blogNews

Aug 5, 2026

ENDLESSDOORS Is Phoning Home. Pick Up. | Blog | VulnCheck

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching5

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping15

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.