Active Exploitation
#threatreport #LowCompleteness
ENDLESSDOORS Is Phoning Home. Pick Up. | 05-08-2026
Source: https://www.vulncheck.com/blog/zbt-endlessdoors
Key details below ↓
💀Threats:
Endlessdoors,
🎯Victims: Hospitality, Transportation, Network infrastructure
🔓CVEs: CVE-2026-66747 \[[Vulners](https://vulners.com/cve/CVE-2026-66747)]
- CVSS V3.1: *9.8*,
- Vulners: Exploitation: Unknown
📚TTPs:
⚔️Tactics: 1
🛠️Technics: 0
🤖LLM extracted TTPs:`
T1036.005, T1037.004, T1059.004, T1095, T1105, T1568, T1571, T1573
🧨IOCs:
- Domain: 3
- IP: 4
- Hash: 26
- File: 1
💽Software: BusyBox, Alibaba Cloud
🔢Algorithms: sha256
🔠Functions: popen
💻Platforms: mips
YARA: Found
#threatreport:
The ENDLESSDOORS malware exemplifies a sophisticated and covert attack technique, allowing threat actors to gain unauthorized access to affected devices by leveraging outbound communication. It utilizes a client-server model where the implant, residing in compromised devices, contacts a command-and-control (C2) server. The specific commands for the implant include requests to run operations as root and establish a root shell, revealing a clear intent to exploit system vulnerabilities.
This malware is notable for its ability to bypass traditional network defenses by initiating connections from within the victim's network, evading measures like NAT or standard firewall rules. This capability means that even devices behind multiple layers of security can be compromised as long as they can reach the C2 server, exemplified by a case where the C2 server was found on a DDNS service. The primary identifier for this vulnerability has been cataloged as CVE-2026-66747.
Multiple router models have been discovered to be affected, with one notable instance being the AX3000, which communicates with the http://wikaba.com endpoint. Other models connect to the domain http://zbtctl.epplink.net, which resolves to an Alibaba Cloud IP address, underscoring the use of cloud services for hosting malicious infrastructure. Organizations are urged to conduct thorough inventories of their devices, focusing on specific models associated with the ENDLESSDOORS malware, such as Zbtlink routers.
Detection and response measures for the ENDLESSDOORS implant include searching for signs of its presence, such as unusual processes in the operating system and the presence of specific configuration files. Network actions associated with the implant are also critical, specifically monitoring egress traffic on ports 7000 and 7001, which are utilized for communication with the C2 infrastructure. To mitigate risks, it is recommended to block and monitor traffic to known malicious endpoints, implement alerts based on outbound traffic behaviors, and consider device replacement in instances where compromised hardware cannot be secured reliably.
Further detection capabilities can be enhanced through the application of established network security rules, specifically tailored for Suricata and Snort intrusion detection systems, as well as the development of a YARA rule for identification of ENDLESSDOORS implants based on specific binary signatures and operational characteristics. This comprehensive approach allows organizations to respond effectively to this emerging threat, minimizing the risk of successful exploitation.
Post summary
This report details an actively exploited vulnerability (CVE‑2026‑66747) causing malicious implants in routers, providing mitigation guidance but no patch or PoC, confirming ongoing real‑world attacks.
