ZBT Routers Shipped with Triple Backdoor Suite Beaconing to PRC C2 Every 35 Seconds

The backdoors predate public disclosure and were present in factory firmware. ENDLESSDOORS initiates outbound connections as frequently as every 35 seconds while the newer pair adds persistent reverse tunnels and log suppression. Analysis showed hardcoded C2 domains tied to Nanjing Xinjiuwei Network Technology, the same entity linked to the QTYF proxy frameworks disrupted by the FBI.

Procurement records and prior CVE patterns indicate this is not isolated. Similar embedded implants have appeared in other Chinese networking hardware used in critical infrastructure, where default trust in shipped devices bypasses normal detection. The original coverage listed the CVEs but omitted cross-referencing with contract awards showing ZBT routers in U.S. municipal and energy deployments.

Operational effect is straightforward: attackers gain network-level proxy access without user interaction, enabling the same reconnaissance and routing sold by QTYF. Independent verification of the beacon intervals and domains remains limited to the firmware samples examined.

Next steps include mandatory firmware audits on imported routers and potential sanctions on the Nanjing entity. Watch for additional models from the same supplier appearing in incident reports within the next quarter.