On my desk in suburban Philadelphia, an AX3000 Dual SIM 5G CPE WiFi 6 is plugged into an isolated research network. Its status lights blink and twinkle as it continuously attempts to reach a command and control server on the internet. The same plays out in homes, offices, and even vehicles across the globe: Zbtlink routers phone , waiting for orders. Not because they were hacked. Because they were shipped that way.
The router on my desk is made by Zbtlink, a brand of Shenzhen Zhibotong Electronics, a Chinese manufacturer that builds routers and white-labels them for sale around the world. The same device shows up on Amazon under both the Zbtlink and Wiflyer brand names, and in Shopify stores like zbtwifi.com and zbtlink.com . We bought our Zbtlink AX3000 (model Z8102AX-2DSIM, also sold as the Z8102AX) off of Alibaba.
The implant is easy to find once you know it’s there.
A kworker is a Linux kernel thread, and it shows up in a process listing wrapped in brackets. The two unbracketed kworkers in the snippet above, from our AX3000, are not kernel threads. They are ordinary userland processes running as root, with real memory footprints, named to disappear into a crowd of legitimate ones. They are an implant, a phone- trojan horse. Our zero-day research team named this ENDLESSDOORS.
ENDLESSDOORS, at its core, is a small tool called rctl (remote control linux). Uploaded to GitHub on January 14, 2015 and never touched again, this obscure repository implements a simple command and control client and server. The server listens on port 7000 for clients to connect. It can send the client individual shell commands or tell the client to spawn a reverse bash shell.
kworker on the AX3000 is a customized version of rctl, and it’s been configured to phone to 47.107.224[.]89 and rbdg4nzqadui[.]wikaba[.]com.
There is no handshake, no key exchange, no negotiation. When the implant reaches a server, it sends a fixed 39-byte hello: a 33-byte class label padded with nulls, then its LAN MAC address. That's the whole registration. There is no client or server verification.
After that, anything the server sends is handed to popen() and executed as uid 0. There is no allow-list and no sandbox. One reserved string, rctlbash , tells the implant to open a second connection to port 7001, allocate a pseudo-terminal, spawn /bin/sh, and bridge it. That is a live interactive root shell.
The vocabulary of this protocol is two phrases: run this as root , and give me a root shell . Anyone along the network path can hijack the client/server communication. Anyone who controls the resolution of rbdg4nzqadui[.]wikaba[.]com, or the address it resolves to, can control any ENDLESSDOORS implant that tries to phone .
Because the device dials out, none of this requires the router to be reachable from the internet. There's no listening port to find and no inbound rule to punch through. The connection originates inside the network and traverses NAT and typical egress filtering the way any outbound TCP session does. A unit sitting behind three layers of firewall in a hotel back office is exactly as reachable as one with a public IP, provided it can get to the C2.
That isn’t theoretical either. We translated the rctl server protocol into a go-exploit and hijacked the outbound rctl communications from our AX3000 client. After the AX3000 announced itself, we told it to give us an interactive shell. And it did.
That is the whole attack. Be the thing the router is already looking for and take over. We’ve assigned this CVE-2026-66747 .
Every firmware on zbtlink.com ’s download page, roughly two dozen images, embeds the rctl implant and starts it at boot with an init.d script named skworker. All of them phone . All of them are hijackable the same way. Affected models:
CPE2801, WE1026-5G-WD, WE1326, WE2007, WE2008-DSIM, WE2416, WE3326, WE5927, WE5931, WE5931AC, WE826-T3-DSIM, WG108, WG1602, WG1608-DSIM, WG209, WG2105, WG2107, WG259, WG3526, Z8102AX-2DSIM
Match on the model number, not the logo on the case. Zbtlink openly sells OEM and ODM services. They will build and rebrand this same hardware and firmware for anyone who wants to put their own name on it. A "Wiflyer WG3526" is the same affected device as its ZBT-labelled twin. The true affected population might be larger than the twenty models we examined, but we have no way to enumerate the rest.
Every affected router dials the same tiny set of endpoints. Across all twenty models it reduces to four primary and secondary endpoints:
Interestingly, our AX3000 is a bit of an odd duck. It phones to wikaba.com (a DDNS service, sort of ideal for non-attribution). All but two other models dial the far more damning zbtctl.epplink[.]net endpoint which currently resolves to 47.100.190[.]96, hosted in Alibaba Cloud.
Coordinated disclosure exists to give a vendor time to fix a defect. It assumes the vendor did not intend the behavior. That assumption doesn't hold here. This isn't a memory corruption bug in a parser. It's a component in the vendor’s product, started at boot by the vendor's own init script, shipped across twenty models and years of images. There is no patch to coordinate. Telling the shipper that they shipped it buys the owners of these devices nothing, and buys whoever operates that infrastructure a warning.
So we're publishing, and we're publishing detection content alongside it so defenders can act today.
There is no fixed firmware. Treat this as a device-trust problem, not a patching problem.
The router on my desk is still plugged in, on a network that goes nowhere. Its lights are still blinking. It still calls out, patient, waiting for someone to pick up.
VulnCheck’s research team tracks real-world exploitation, attacker infrastructure, and exploit workflows using our Canary Intelligence , Exploit & Vulnerability Intelligence (EVI), and IP Intelligence datasets. For more research like this check out our blogs, Frost Checks First , The Mystery OAST Host Behind a Regionally Focused Exploit Operation , and XWiki Under Increased Attack .
The 21 firmware images below, published on Zbtlink's download page , were confirmed to contain ENDLESSDOORS. The hash is the SHA-256 of the kworker binary; identical hashes indicate the same build shipped across multiple images.
Below is the SHA-256 of the images embedded kworker binary.
Network indicators associated with ENDLESSDOORS.
The following rule matches the kworker and librctl.so binaries across every observed build, MIPS and aarch64:
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
