Zbtlink Chinese Router Sold Worldwide Contains a Hidden Backdoor Affecting 20+ Models

Zbtlink routers sold globally have been identified with a covert remote-control implant that initiates when activated.

Indicators of Compromise (IoCs): - Domain: zbtctl.epplink[. ]net - Primary ENDLESSDOORS command-and-control domain - IP address: 47.100.190[. ]96 Resolution for zbtctl.epplink[.

]net - IP address: 47.107.224[. ]89 Hardcoded command-and-control address - Domain: online-string[. ]com - Secondary command-and-control domain - IP address: 45.32.81[. ]152 Resolution for online-string[.

]com - Domain: rbdg4nzqadui[.]wikaba[. ]com - Secondary command-and-control domain - IP address: 43.248.136[. ]125 Resolution for rbdg4nzqadui[.]wikaba[. ]com - File path: /usr/sbin/kworker ENDLESSDOORS implant binary - File path: /usr/lib/librctl.so Related remote-control library - File path: /etc/kworker.cfg Implant configuration file - File path: /etc/init.d/skworker Startup script used to launch the implant - Network port: TCP/7000 Implant check-in and command channel - Network port: TCP/7001 Interactive shell connection - Command string: rctlbash String that requests an interactive root shell - Firmware file: / SHA-256 CPE2801_V22.10.09.bin / b3956cfbebf9c8d0b2c7a2ecbe59e71c31a5802f2084d25d93a984c0f811e2c7 Affected firmware image - Firmware file: / SHA-256 WE1026-5G-WD_V21.04.07.bin / f961e4243e759453294340bc7d1b145016d70b97ab328caf47c64ea3cd818148 Affected firmware image - Firmware file: / SHA-256 WE1326_V22.02.18_1.bin / 7791de11cd27cb596deff089904a6eab3a7e0aa391f867c2389582d5c78fef4c Affected firmware image - Firmware file: / SHA-256 WE2007_V23.08.12.bin / 6926f919da7f4447229f49842266d884369e1587df655149673e46f1d8787e47 Affected firmware image - Firmware file: / SHA-256 WE2008-DSIM_V23.08.11.bin / 09ed9ad3ac886f5aaf8357127b6dd5926bd4af1e2cc687a6a4856bcaedee2667 Affected firmware image - Firmware file: / SHA-256 WE2416_V21.03.22_1.bin / 76a17581bbde4c0550e8f4abfd903923aceeb50dc69dae4dd904628c273b90ee Affected firmware image - Firmware file: / SHA-256 WE2416_V21.03.22.bin / 76a17581bbde4c0550e8f4abfd903923aceeb50dc69dae4dd904628c273b90ee Affected firmware image - Firmware file: / SHA-256 WE3326_V20.09.30.bin / f5a94e536a1cac8552fb9c327c4bac6017e034786be98cc402a149cb51250d8f Affected firmware image - Firmware file: / SHA-256 WE826-T3-DSIM_V21.12.21.bin / b3e667235e9b41b8fc3594edaa64879750e7f75d7518fff7514d55837430411a Affected firmware image - Firmware file: / SHA-256 WG108_V21.08.06_1.bin / 37efadf0f4a110be0145139a43ebd032abb5b27b79b1eb2ab3578dcd31655a9e Affected firmware image - Firmware file: / SHA-256 WG1602_V23.10.11.bin / f019d03c2489b2bc486d71e355e07f8f2862dff078574a8662a5a45932e7e453 Affected firmware image - Firmware file: / SHA-256 WG1608-DSIM_V23.03.16.bin / 73a0d95b8e23c7780cd91e978238c6db519665b05481fb228b4db9a9ec99c8ae Affected firmware image - Firmware file: / SHA-256 WG209_V21.07.28.bin / efc8a8ead69c63ecfffd883cfbe6bd131082aa13c0d3b324c00d79f4c149bd92 Affected firmware image - Firmware file: / SHA-256 WG2105_V22.05.30.bin / 1545169fa8a3ae182d8e39aca8ec6cb6849b864e38646f29017232813e397e77 Affected firmware image - Firmware file: / SHA-256 WG259_V21.03.23.bin / b4fda77e082fbf961db02273999e92e715e1824140ea92b2ab30163338b6622b Affected firmware image - Firmware file: / SHA-256 WG3526_V22.11.01.bin / 2d558bc9a6c7e7480e946f1c0524a651554887a1c563d7633f1903d06ff493fb Affected firmware image - Firmware file: / SHA-256 Z8102AX-2DSIM-..._174431.bin / dcdaa1fe80707b8d8fde8ad36c3e62a53623aff09bf5ccc544d4c1a1a54208b8 Affected firmware image - Firmware file: /...