Back to Intelligence

ENDLESSDOORS Router Backdoor + Legion Loader TDS + MUSTANG PANDA ZOHOMURK: OTX Pulse Analysis — Enterprise Detection Pack

SA
Security Arsenal Team
August 7, 2026
11 min read

Threat Summary

Three concurrent threat activity clusters dominate this intelligence cycle, each representing a distinct stage of the criminal and espionage economy — and collectively illustrating how initial access, traffic monetization, and state-sponsored collection pipelines interlock.

Cluster 1 — Supply-chain IoT compromise (ENDLESSDOORS / CVE-2026-66747). Zbtlink routers manufactured by Shenzhen Zhibotong Electronics and resold globally under brand names including Wiflyer ship with a pre-installed backdoor implant derived from the open-source rctl remote administration tool. The implant runs as userland processes masquerading as kworker (Linux kernel worker threads) and beacons persistently to command-and-control infrastructure. This is not a vulnerability introduced post-sale — it is factory-seated access, meaning every deployed device is born compromised. Such footholds are routinely resold or leased on underground forums as residential proxy capacity and initial access broker inventory.

Cluster 2 — Criminal traffic monetization (Fake CAPTCHA TDS / Legion Loader). A traffic distribution system (TDS) has operated for 14+ months using over 12,700 structurally identical fake CAPTCHA PDFs hosted on Webflow's CDN, seeded through search engine poisoning. Victims searching Google for legitimate documents land on PDFs containing fake CAPTCHA verification panels that route them through a custom engagement chain, ultimately delivering Legion Loader and Trojan.Win32.Injuke, with premium SMS scams as a monetization branch. Notably, researchers observed exposure through AI assistants that surface the poisoned PDFs — an emerging delivery surface. Targeting spans the US, UK, Canada, Australia, and India.

Cluster 3 — State-sponsored espionage (MUSTANG PANDA / ZOHOMURK / MINIRECON). Between May and June 2026, MUSTANG PANDA ran two parallel campaigns against Indian government entities and hydropower/energy infrastructure, using DLL sideloading via legitimate signed executables to deploy SHARDLOADER, MINIRECON (a TONESHELL evolution with WebSocket-based C2), and ZOHOMURK, alongside known tooling (SHADOWPAD, PUBLOAD, POISONPLUG.SHADOW). The objective is long-dwell intelligence collection against critical infrastructure.

The through-line: commodity access (backdoored routers, TDS-delivered loaders) feeds the same underground marketplaces where espionage-aligned actors procure infrastructure and footholds. Defenders must treat these as one ecosystem.

Threat Actor / Malware Profile

ENDLESSDOORS (rctl-based pre-installed implant)

  • Distribution: Factory pre-installation on Zbtlink/Wiflyer router firmware — classic supply-chain implant. No user action required for compromise.
  • Payload behavior: Executes as disguised userland processes named kworker to blend with legitimate kernel worker threads; provides unauthenticated remote access to the device.
  • C2 communication: Continuous outbound beaconing to hardcoded C2 servers; tracked as CVE-2026-66747.
  • Persistence: Firmware-resident — survives reboots and, absent a firmware replacement, survives factory resets.
  • Anti-analysis: Process-name masquerading; implant logic buried in vendor firmware images that most enterprises never audit.

Legion Loader / Trojan.Win32.Injuke (TDS-delivered)

  • Distribution: Search engine poisoning → Webflow CDN-hosted PDF → fake CAPTCHA social engineering → copy-paste execution (ClickFix-style) or scripted redirect chain. AI assistant result surfacing is a secondary exposure vector.
  • Payload behavior: Legion Loader acts as a multi-stage dropper, fingerprinting the host before pulling secondary payloads; Injuke provides injection and payload staging.
  • C2 communication: Custom engagement/telemetry domain chain (e.g., berapt-medii.com, zuwufag.com, binonelola.com, bovetewa.com, dutabuz.com) with DGA-like disposable domain rotation.
  • Persistence: Registry Run keys and scheduled tasks are typical for this loader family.
  • Anti-analysis: CAPTCHA-gating defeats sandboxes and scanners; PDF lures carry no malicious signature until user interaction triggers the chain.

MUSTANG PANDA tooling (SHARDLOADER → MINIRECON / ZOHOMURK)

  • Distribution: Spearphishing and staged archives; DLL sideloading via legitimate, often signed, executables.
  • Payload behavior: SHARDLOADER stages the implants. MINIRECON — an evolution of TONESHELL — performs host reconnaissance and tasking. ZOHOMURK extends collection capability against government and energy targets.
  • C2 communication: WebSocket-based C2 (MINIRECON) blended into legitimate HTTPS traffic; cloud-hosted C2 fronting (e.g., couldinstallup.com).
  • Persistence: DLL sideload chains paired with scheduled tasks and service creation; SHADOWPAD/PUBLOAD lineage provides modular persistence.
  • Anti-analysis: Signed-binary sideloading defeats naive application allowlisting; WebSocket channels evade simple HTTP-inspection signatures.

IOC Analysis

The pulse set contains three indicator classes, each requiring different operational handling:

File hashes (MD5 / SHA1 / SHA256) — The largest class across all three pulses. SHA256 values for ENDLESSDOORS firmware components and MUSTANG PANDA loaders/implants should be pushed directly into EDR blocklists and your threat intelligence platform's hash-watch feeds. Note the MD5/SHA1 entries exist for legacy tooling correlation — normalize on SHA256 where available. Hashes are high-fidelity but brittle: use them for retrospective sweeps and blocking, not as your sole detection layer.

Domains — TDS engagement domains (berapt-medii.com, zuwufag.com, binonelola.com, bovetewa.com, dutabuz.com) and MUSTANG PANDA C2 (couldinstallup.com). Feed these into DNS sinkholes, secure web gateway block categories, and passive DNS monitoring. For the TDS cluster, also alert on HTTP referrers from *.webflow.io serving PDF content combined with CAPTCHA-related URI patterns — the infrastructure pattern outlives any single domain.

CVE (CVE-2026-66747) — Not a traditional IOC. Operationalize as an asset inventory question: identify every Zbtlink/Wiflyer-manufactured router on your network (including remote-worker home gateways and OT edge devices). Because the implant is firmware-resident, patching is not sufficient — device replacement or verified-clean third-party firmware is the remediation path.

Tooling: Normalize all indicators into STIX/TAXII ingestion for your SIEM. YARA scanning of firmware images and memory captures covers the hash class; Zeek/Suricata with the domain list plus JA3/JA4 fingerprinting covers network detection; WebSocket-aware inspection is required for MINIRECON C2.

Detection Engineering

YAML
---
title: ENDLESSDOORS rctl Implant Process Masquerading as kworker
id: 7f3a1c2e-9d4b-4e6a-b8c1-2f5d7a9e3b01
status: experimental
description: Detects userland processes named kworker executing from non-standard paths, consistent with the ENDLESSDOORS pre-installed router implant (CVE-2026-66747) which disguises itself as kernel worker threads.
author: Security Arsenal Threat Intelligence
date: 2026/08/07
references:
    - https://www.vulncheck.com/blog/zbt-endlessdoors
logsource:
    category: process_creation
    product: linux
detection:
    selection_name:
        Image|endswith: '/kworker'
    filter_legit_paths:
        Image|startswith:
            - '/usr/bin/kworker'
            - '/sbin/kworker'
    condition: selection_name and not filter_legit_paths
falsepositives:
    - Legitimate kernel threads are not userland processes; any Image-based match from a writable path is highly suspicious
level: high
tags:
    - attack.persistence
    - attack.defense_evasion
    - attack.t1036
---
title: MUSTANG PANDA MINIRECON WebSocket C2 via DLL Sideload Chain
id: 4b8e2d1f-6c3a-4f7b-a9e2-8d1c5b6a4e02
status: experimental
description: Detects suspicious DLL sideloading behavior where a legitimate signed executable loads a DLL from a non-system directory, followed by outbound WebSocket connections, consistent with SHARDLOADER staging MINIRECON/ZOHOMURK.
author: Security Arsenal Threat Intelligence
date: 2026/08/07
references:
    - https://www.acronis.com/en/tru/posts/mustang-panda-targets-indias-government-and-energy-sectors/
logsource:
    category: image_load
    product: windows
detection:
    selection_dll:
        ImageLoaded|endswith: '.dll'
    selection_suspicious_path:
        ImageLoaded|contains:
            - '\AppData\Local\Temp\'
            - '\Users\Public\'
            - '\ProgramData\'
            - '\AppData\Roaming\'
    filter_system:
        ImageLoaded|startswith:
            - 'C:\Windows\System32\'
            - 'C:\Windows\SysWOW64\'
    condition: selection_dll and selection_suspicious_path and not filter_system
falsepositives:
    - Legitimate portable applications loading bundled DLLs
level: high
tags:
    - attack.defense_evasion
    - attack.persistence
    - attack.t1574.002
---
title: Fake CAPTCHA TDS Follow-on Execution from PDF Reader
id: 9c5f3a7d-2e8b-4d6c-b1a4-7f3e9c2d5a03
status: experimental
description: Detects script interpreters or command shells spawned by PDF reader processes, consistent with fake CAPTCHA PDF lures delivering Legion Loader via search engine poisoning and Webflow CDN abuse.
author: Security Arsenal Threat Intelligence
date: 2026/08/07
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith:
            - '\AcroRd32.exe'
            - '\Acrobat.exe'
            - '\msedge.exe'
            - '\chrome.exe'
            - '\firefox.exe'
    selection_child:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\cmd.exe'
            - '\mshta.exe'
            - '\wscript.exe'
            - '\cscript.exe'
            - '\rundll32.exe'
    condition: selection_parent and selection_child
falsepositives:
    - Rare; browser-launched installers with user consent
level: high
tags:
    - attack.execution
    - attack.initial_access
    - attack.t1204.002
    - attack.t1059
KQL — Microsoft Sentinel / Defender
// Security Arsenal — Multi-campaign hunt: ENDLESSDOORS beaconing, TDS domains, MUSTANG PANDA C2
// Scope: last 14 days across network and process telemetry
let tds_domains = dynamic(["berapt-medii.com","zuwufag.com","binonelola.com","bovetewa.com","dutabuz.com"]);
let espionage_c2 = dynamic(["couldinstallup.com"]);
let NetworkHits = DeviceNetworkEvents
| where Timestamp > ago(14d)
| where RemoteUrl has_any (tds_domains) or RemoteUrl has_any (espionage_c2)
| extend Campaign = case(
    RemoteUrl has_any (tds_domains), "FakeCAPTCHA-TDS / Legion Loader",
    RemoteUrl has_any (espionage_c2), "MUSTANG PANDA / MINIRECON",
    "Unknown")
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteUrl, RemoteIP, RemotePort, Campaign;
let WebflowLures = DeviceNetworkEvents
| where Timestamp > ago(14d)
| where RemoteUrl has "webflow.io" and InitiatingProcessFileName in~ ("AcroRd32.exe","Acrobat.exe","msedge.exe","chrome.exe")
| extend Campaign = "FakeCAPTCHA-TDS lure staging"
| project Timestamp, DeviceName, InitiatingProcessFileName, RemoteUrl, RemoteIP, Campaign;
let SideloadBehavior = DeviceImageLoadEvents
| where Timestamp > ago(14d)
| where FolderPath has_any ("\\AppData\\Local\\Temp\\","\\Users\\Public\\","\\ProgramData\\","\\AppData\\Roaming\\")
| where FileName endswith ".dll"
| extend Campaign = "Possible SHARDLOADER DLL sideload"
| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, FolderPath, SHA256, Campaign;
union NetworkHits, WebflowLures, SideloadBehavior
| sort by Timestamp desc
PowerShell
# Security Arsenal — IOC Hunt: ENDLESSDOORS / Legion Loader / MUSTANG PANDA
# Run elevated. Checks network beacons, loader persistence, and malware hashes.

$ErrorActionPreference = 'SilentlyContinue'
$report = @()

# --- 1. Known-bad domains: check active & cached connections ---
$badDomains = @('berapt-medii.com','zuwufag.com','binonelola.com','bovetewa.com','dutabuz.com','couldinstallup.com')
foreach ($d in $badDomains) {
    $hit = Get-NetTCPConnection | Where-Object { $_.RemoteAddress -ne '0.0.0.0' } |
        ForEach-Object {
            $dns = (Resolve-DnsName -Name $d -ErrorAction SilentlyContinue | Where-Object {$_.Type -eq 'A'}).IPAddress
            if ($dns -and ($_.RemoteAddress -in $dns)) { $_ }
        }
    if ($hit) { $report += [pscustomobject]@{Check='C2 Connection'; Detail="Live connection to $d"; Severity='CRITICAL'} }
}

# --- 2. DNS cache review for TDS/C2 resolution evidence ---
$cache = Get-DnsClientCache | Where-Object { $_.Entry -match 'berapt-medii|zuwufag|binonelola|bovetewa|dutabuz|couldinstallup' }
if ($cache) { $report += [pscustomobject]@{Check='DNS Cache'; Detail=($cache.Entry -join ', '); Severity='HIGH'} }

# --- 3. Loader persistence: Run keys and suspicious scheduled tasks ---
$runKeys = @('HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run',
             'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run')
foreach ($k in $runKeys) {
    Get-ItemProperty -Path $k | ForEach-Object {
        $_.PSObject.Properties | Where-Object { $_.Value -match 'Temp|Public|ProgramData|AppData' } |
            ForEach-Object { $report += [pscustomobject]@{Check='Run Key'; Detail="$k :: $($_.Name) = $($_.Value)"; Severity='MEDIUM'} }
    }
}
Get-ScheduledTask | Where-Object {
    $_.Actions.Execute -match 'powershell|mshta|wscript|rundll32' -and
    $_.TaskPath -notlike '\Microsoft*'
} | ForEach-Object { $report += [pscustomobject]@{Check='Scheduled Task'; Detail="$($_.TaskName): $($_.Actions.Execute) $($_.Actions.Arguments)"; Severity='MEDIUM'} }

# --- 4. Hash sweep: MUSTANG PANDA / Legion Loader samples in common staging dirs ---
$badHashes = @(
 'fcf4efa82d477c924d42cc6b71aa672ab2381ca256769925ae34dabe2e77e025',
 '390148f5157c0f6b337ff19d162c3c2ee3e6d782fdfbe11fb1e411c0684fd33b',
 'f53fd0626404a129dcddb8ee7589387dd7bda7999814e0df46c670af6b3da5f5',
 '87b8b76762eac941c562c6c8eefb8402f48fc70fcfe360a274b12e75dd5726e2'
)
$dirs = @("$env:TEMP","$env:PUBLIC","$env:ProgramData","$env:APPDATA","$env:LOCALAPPDATA")
foreach ($dir in $dirs) {
    Get-ChildItem -Path $dir -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object {
        $h = (Get-FileHash $_.FullName -Algorithm SHA256).Hash.ToLower()
        if ($badHashes -contains $h) {
            $report += [pscustomobject]@{Check='Malware Hash'; Detail="$($_.FullName) [$h]"; Severity='CRITICAL'}
        }
    }
}

# --- 5. WebSocket-style long-lived outbound connections from non-browser processes ---
Get-NetTCPConnection -State Established | Where-Object {
    $_.RemotePort -in 443,8443,8080 -and $_.OwningProcess -gt 4
} | ForEach-Object {
    $p = Get-Process -Id $_.OwningProcess
    if ($p.ProcessName -notmatch 'chrome|msedge|firefox|teams|slack|outlook') {
        $report += [pscustomobject]@{Check='Anomalous TLS Session'; Detail="$($p.ProcessName) (PID $($p.Id)) -> $($_.RemoteAddress):$($_.RemotePort)"; Severity='LOW'}
    }
}

$report | Sort-Object Severity | Format-Table -AutoSize | Out-String -Width 4096
Write-Host "`n[Hunt complete] $($report.Count) findings. Review CRITICAL items immediately." -ForegroundColor Yellow

Response Priorities

Immediate (0–4 hours)

  • Block all listed domains at DNS resolver, secure web gateway, and EDR network protection layers: berapt-medii.com, zuwufag.com, binonelola.com, bovetewa.com, dutabuz.com, couldinstallup.com.
  • Push SHA256 indicators from all three pulses into EDR prevention (not just detection) and sweep mail gateways and download caches for the fake CAPTCHA PDF hash.
  • Inventory Zbtlink/Wiflyer routers across corporate, branch, OT, and remote-worker environments. Quarantine identified devices from segments containing sensitive assets; CVE-2026-66747 devices cannot be trusted even behind a firewall — they may serve as C2 relays.
  • Hunt execution artifacts: PDF readers spawning script interpreters, DLL loads from user-writable directories, and kworker-named userland processes on Linux network appliances.

24 Hours

  • Credential verification: Legion Loader deployments routinely chain into infostealers. For any host with a TDS-domain hit or loader hash match, force password resets for all interactive sessions and rotate tokens for sessions active on that host. Audit for anomalous MFA prompts and impossible-travel logins.
  • Retro DNS and proxy log review for 90 days against the indicator set — the TDS has operated 14+ months, so current blocklists capture only the latest rotation.
  • Energy/government-adjacent organizations: review DLL sideload telemetry and outbound WebSocket sessions (long-lived TLS on 443 from non-browser processes) per the MUSTANG PANDA tradecraft above.

1 Week

  • Segment IoT/edge devices into untrusted VLANs with egress allowlisting; no consumer-grade router should have a direct path to internal assets.
  • Procurement policy update: require firmware attestations and SBOMs for network hardware; add Zbtlink-manufactured devices (all rebadges) to prohibited-purchase lists pending vendor remediation of CVE-2026-66747.
  • User hardening: deploy ClickFix/fake-CAPTCHA awareness content and consider browser isolation for PDF rendering from search results; block or sandbox Webflow-hosted PDFs at the proxy for high-risk user groups.
  • Application control tuning: tighten DLL search-order mitigations and WDAC/AppLocker rules to prevent sideloading from user-writable paths — this directly counters SHARDLOADER staging.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub

darkwebotx-pulsedarkweb-malwareendlessdoorslegion-loadermustang-pandazohomurksupply-chain

Is your security operations ready?

Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.

Book a SOC AssessmentSee AlertMonitor in Action