Recent coverage by Reuters highlights Chinese router manufacturer ZBT (Zbtlink) after multiple built-in firmware backdoors were discovered. While the vendor initially claimed a previously found backdoor (ENDLESSDOORS) was merely a tool for customer troubleshooting, new evidence disputes this.
As detailed in research by Jacob Baines and the team at VulnCheck, at least two additional backdoors, DARKLANTERN and SPEAKINGSTONE, have been uncovered within the supply chain. These implants, found embedded in the firmware of consumer and commercial edge routers worldwide, grant remote operators unauthenticated root execution, DNS hijacking capabilities, and credential exfiltration tools.
Understanding the technical mechanisms of this supply chain compromise is critical for IT and OT defenders. Below is our technical breakdown of the backdoors, alongside TTPs and IoCs to assist your threat hunting efforts.
Credit for the primary discovery, sinkholing operations, and reverse engineering belongs to VulnCheck. We recommend reading their full technical breakdown.
The Threat: White-Labeled Risks
Shenzhen Zhibotong Electronics (ZBT) rarely sells hardware under its own name. Instead, they act as an Original Equipment Manufacturer (OEM) for global brands. ZBT hardware is rebranded and sold worldwide for use in RVs, roadside billboards, and small business backups.
Because ZBT white-labels their platforms, organizations may unknowingly have these devices on their networks under brands like WiFlyer, Cioswi, CroSkylink, KuWFi, Deep Orange, and others. Wherever the hardware goes, the backdoors follow.
The Backdoors: DARKLANTERN and SPEAKINGSTONE
Both implants are written in Nim, communicate over UDP, and are launched by a connectivity watchdog binary named inetdetect.
DARKLANTERN (The Listener)
Running as infosrvd, DARKLANTERN is a backdoor that explicitly listens on UDP port 9992 for inbound connections on the WAN interface. It is entirely unauthenticated and unencrypted.
- Info Probes: A 19-byte probe sent to the port causes the device to reply to UDP/8897 with a full device fingerprint (MAC, IP, firmware, uptime).
- Command Execution: Command packets parse payloads directly into
system("/etc/exec/cmd " + payload). Attackers bypass the intended MAC address filter by supplying a MAC of all zeros. The required checksum is computed using a hardcoded, unchangeable salt (mqonu.com).
SPEAKINGSTONE (The Beacon)
While DARKLANTERN relies on the router being internet-facing, SPEAKINGSTONE (running as yunmgrd) takes an outbound approach. It periodically beacons out to a C2 server over UDP port 10000.
- Functionality: Far exceeding any troubleshooting scope, this implant can execute arbitrary commands, exfiltrate WAN PPPoE credentials, modify DNS hijack lists, and open reverse SSH tunnels into private networks.
- Sinkholing Success: The primary hardcoded C2 is
ac-link[.]com(hosted on Alibaba Cloud). VulnCheck successfully sinkholed SPEAKINGSTONE's obfuscated backup domain,www.findmyipaddr[.]com. Hundreds of active devices, mostly carrier CPE routers inside China, immediately began beaconing full device fingerprints to VulnCheck's servers. This confirmed the massive scale of the deployment.
MITRE ATT&CK TTPs
Below is a mapping of the Tactics, Techniques, and Procedures (TTPs) associated with these implants.
| Tactic | Technique | ID | Description |
|---|---|---|---|
| Initial Access | Supply Chain Compromise | T1195.002 | Implants are shipped pre-installed in the OEM firmware of Zbtlink/ZBT routers globally. |
| Execution | Command and Scripting Interpreter | T1059.004 | Arbitrary shell commands are executed via /etc/exec/cmd. |
| Persistence | Boot or Logon Autostart Execution | T1547 | Backdoors automatically start on boot via the inetdetect watchdog binary. |
| Defense Evasion | Obfuscated Files or Information | T1027 | SPEAKINGSTONE obfuscates its backup C2 domain in fragments and XOR-obfuscates outbound UDP traffic (0x1f). |
| Credential Access | Credentials from Password Stores | T1555 | SPEAKINGSTONE uses msgType 0x2502 to target and exfiltrate PPPoE credentials. |
| Command and Control | Non-Application Layer Protocol | T1095 | Uses custom protocols (zbtProtocol and revProto) over standard UDP ports (9992, 10000). |
| Command and Control | Ingress Tool Transfer | T1105 | SPEAKINGSTONE can download and establish a reverse SSH tunnel via msgType 0x2405. |
| Impact | Network Denial of Service / DNS Hijacking | T1565.002 | SPEAKINGSTONE alters DNS routing (msgType 0x230b) to redirect network traffic. |
Indicators of Compromise (IoCs)
To detect DARKLANTERN and SPEAKINGSTONE in your environment, monitor for the following IoCs.
File Hashes (SHA-256)
b77811db4d218c65670a6c9a5b33c30ff81c6d779e15d658643138771178a818(yunmgrd/ SPEAKINGSTONE)7e2e036fec2fe7ab4bbd43978d9296563894c92a112f5ac2f39957f12108e245(infosrvd/ DARKLANTERN)ae6c356f1f09260b859f84d994ef8423540a6c0bdf98510d86b85834283e4926(inetdetect/ Watchdog)
Network Infrastructure (C2 Domains)
www.ac-link[.]com(SPEAKINGSTONE Primary C2)www.findmyipaddr[.]com(SPEAKINGSTONE Backup C2 / Sinkholed)
Network Traffic and Ports
- UDP 9992 (DARKLANTERN inbound listener)
- UDP 8897 (DARKLANTERN outbound data response)
- UDP 10000 (SPEAKINGSTONE outbound C2 beaconing)
Detection Signatures
If your organization utilizes Suricata, inspect UDP 9992 for DARKLANTERN command packets matching the hex prefix:
|0c 17 1f 12 34 56 00 00 00 00 00 00|
For SPEAKINGSTONE C2 DNS lookups, alert on queries to:
www.ac-link[.]com
Remediation and Defense
ZBT routers have proven to be systematically compromised across multiple generations of firmware. Due to the unauthenticated nature of these backdoors and the complex web of white-labeling, defenders should take the following steps.
- Audit Hardware Assets: Identify the MAC addresses of any white-labeled routers to check if they belong to ZBT's OUI block (e.g., starting with
78:A3:51). - Network Segmentation: Immediately disconnect suspected edge devices from sensitive IT/OT networks. If they must be used, place them strictly behind secondary firewalls that block all inbound WAN requests and restrict arbitrary outbound UDP traffic.
- Monitor UDP Traffic: Alert on unexpected UDP beaconing over ports 9992 and 10000.
- Replace Affected Hardware: Given the nature of these surveillance implants, patching or flashing firmware is unreliable. Disconnecting and replacing ZBT-derived appliances is the most secure option.
Acknowledgments: We extend our gratitude to Jacob Baines and the VulnCheck team for their original vulnerability intelligence and reverse engineering work that brought these threats to light. Visit VulnCheck's official blog for granular technical insights and ASM fingerprints.