Loading malware…
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
23 distinct techniques documented for this family, organized by ATT&CK tactic.
One reserved string, rctlbash, tells the implant to open a second connection to port 7001, allocate a pseudo-terminal, spawn /bin/sh, and bridge it," Baines explained. "That is a live interactive root shell." | The server listens on port 7000 for clients to connect. It can send the client individual shell commands or tell the client to spawn a reverse bash shell.
It's a component in the vendor’s product, started at boot by the vendor's own init script, shipped across twenty models and years of images
Because the device dials out, none of this requires the router to be reachable from the internet. There's no listening port to find and no inbound rule to punch through. The connection originates inside the network and traverses NAT and typical egress filtering
« ENDLESSDOORS ... est un implant compilé dans chaque image firmware examinée ... couvrant plus de 20 modèles distincts. »
VulnCheck researchers found a backdoor baked into Zbtlink routers... Two processes named “kworker” were running as root... The researchers pointed out that twenty different router models carry the same backdoor, all of them starting it automatically at boot through an init script named skworker.
It's a component in the vendor’s product, started at boot by the vendor's own init script, shipped across twenty models and years of images
VulnCheck researchers found a backdoor baked into Zbtlink routers... Two processes named “kworker” were running as root... The researchers pointed out that twenty different router models carry the same backdoor, all of them starting it automatically at boot through an init script named skworker.
They masquerade as a Linux kernel thread, but are actually userland processes running with root privileges while blending their true functionality with other legitimate kworker processes.
„Die versteckt sich mit dem Namen ‚kworker‘ als Userland-Prozess mit root-Rechten und imitiert dadurch echte kworker-Prozesse.“
The backdoor functions as a persistent communication mechanism, where the compromised router automatically beacons to a specific IP address and a Chinese-registered domain every 35 seconds. This automated outbound communication suggests a structured infrastructure designed for command-and-control capabilities
T1071.001 — Application Layer Protocol: Web Protocols (Command and Control)
L’attaque fonctionne même derrière NAT et pare-feu car la connexion est initiée par le routeur.
Protocole C2 : connexion sortante TCP vers le port 7000 ... Aucune authentification, aucun chiffrement, aucune vérification client/serveur
7 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Open-source remote-control tool whose modified build was used as the basis for the ENDLESSDOORS implant.
Open-source remote control Linux tool that served as the basis for the customized ENDLESSDOORS implant found in the router firmware.
Open-source remote control tool forming the basis of ENDLESSDOORS. Its server listens on port 7000 and can send shell commands or trigger a reverse shell, with no authentication or key exchange described in the report.
A simple command-and-control client/server tool that listens on port 7000, can execute shell commands, and can instruct clients to spawn a reverse bash shell. The ENDLESSDOORS implant is described as a customized version of rctl.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.