- The Mess: Security researchers found two previously undocumented implants, DARKLANTERN and SPEAKINGSTONE, embedded in firmware shipped with ZBT routers sold worldwide. DARKLANTERN exposes an unauthenticated root command interface over the Internet, while SPEAKINGSTONE phones home to a hardcoded C2 server.
- The Damage: An attacker can potentially obtain root control of an affected router, steal WAN credentials, manipulate DNS settings or establish a reverse SSH tunnel.
- The Fix: Identify affected ZBT hardware immediately and replace it if possible; no confirmed fixed firmware has been published for the newly disclosed implants.
Your router may not have a vulnerability.
It may have something worse.
A backdoor.
Security researchers at VulnCheck found two previously undocumented surveillance implants hidden inside firmware produced by Shenzhen Zhibotong Electronics, better known as ZBT.
The implants are called:
DARKLANTERN
and
SPEAKINGSTONE
Both can provide remote attackers with root-level command execution.
No user interaction.
No legitimate administrator credentials.
No exploit chain against a web browser.
Just the router doing what its firmware tells it to do.
This Isn’t Just One Router
That’s the first important detail.
Researchers originally purchased an $88 Deep Orange 3G/4G/LTE router from a U.S. supplier.
It looked like a normal white-label product.
Underneath the branding?
ZBT-WE826-T2.
The router was running firmware built in 2019.
And it contained two implants.
The same hardware platform is sold under different brands, which makes identifying affected equipment much harder.
The logo on the front may tell you almost nothing.
The firmware does.
DARKLANTERN Is the Ugly One
DARKLANTERN runs as a service called:
infosrvd
It listens on UDP port 9992.
The router’s own firewall exposes that service to inbound traffic from the Internet.
That’s already bad.
Then the researchers looked at authentication.
It wasn’t really authentication.
The protocol relies on a hardcoded checksum salt.
The MAC-address validation can also be bypassed by sending an all-zero MAC value.
The result?
A remote attacker can forge packets and reach the implant’s command functionality.
As root.
203 Routers Answered
VulnCheck scanned the Internet between August 18 and August 21.
They identified 203 Internet-facing DARKLANTERN instances across 22 countries.
The devices reported 16 different router models.
And that’s only what answered the researchers’ probes.
It does not mean that only 203 devices contain the implant.
It means 203 were visibly reachable from the public Internet during the scan.
The actual installed base could be substantially larger.
That’s the part that should make network administrators uncomfortable.
The researchers weren’t searching for compromised routers.
They were searching for routers that already exposed the backdoor.
SPEAKINGSTONE Plays a Different Game
DARKLANTERN listens.
SPEAKINGSTONE calls home.
It runs as:
yunmgrd
and communicates with a hardcoded command-and-control server over UDP port 10000.
Because the connection is outbound, the implant can operate even when the router sits behind NAT.
That’s a nasty property.
A router doesn’t have to expose its management interface directly to the Internet for the implant to communicate with its operator.
The router initiates the connection itself.
Root Isn’t the Only Problem
SPEAKINGSTONE supports commands capable of doing considerably more than simply checking whether the router is alive.
Researchers found functionality for:
arbitrary command execution
WAN PPPoE credential extraction
DNS hijacking
reverse SSH tunnels
That’s enough to turn a network router into a very useful foothold.
Compromise the router.
Own the network path.
Then decide what happens next.
DNS Hijacking Is Particularly Nasty
A compromised router can potentially influence where users are sent.
That’s dangerous because the victim may not see anything obviously wrong.
You type:
bank.example
The browser still shows a familiar address.
The router, however, could manipulate DNS resolution.
The attacker doesn’t necessarily need to compromise the bank.
They can attack the infrastructure sitting between the user and the Internet.
That’s exactly why router compromise has consequences beyond the router itself.
And Then There Were Three
This isn’t the first ZBT implant discovered by VulnCheck.
Earlier research identified ENDLESSDOORS, tracked as CVE-2026-66747.
It was found across at least 20 ZBT router models.
That implant also provided a path to root command execution.
The newer investigation found that another firmware generation contained DARKLANTERN and SPEAKINGSTONE instead.
So the current picture is:
ENDLESSDOORS
plus
DARKLANTERN
plus
SPEAKINGSTONE
Three separate implant-like components discovered in ZBT firmware.
That’s a Supply-Chain Problem
A normal vulnerability looks something like:
software → bug → exploit
This looks different.
The problem is inside the firmware supplied with the hardware.
And the hardware is then sold under other names.
That creates a supply-chain problem.
A reseller can honestly sell you a router under its own brand while the underlying device is manufactured by ZBT.
The customer may never know who actually built the firmware.
The Same Hardware Has Different Names
This is why researchers recommend checking the model and hardware identifiers, rather than trusting the brand printed on the case.
ZBT manufactures equipment for OEM and ODM customers.
One router can therefore appear under multiple commercial names.
The security problem follows the firmware.
Not the logo.
There May Not Be a Clean Firmware Escape
This is another ugly detail.
The public advisories identify affected firmware builds.
But no confirmed fixed firmware release has been published for the newly disclosed DARKLANTERN and SPEAKINGSTONE implants.
That leaves owners in an awkward position.
If the device is affected, updating isn’t necessarily an available solution.
And if the manufacturer doesn’t provide a trustworthy remediation path, replacing the hardware may be the safer option.
VulnCheck recommends replacement rather than relying on a firmware update for the affected devices.
The Sinkhole Made Things Even More Interesting
SPEAKINGSTONE contains a hardcoded backup C2 domain.
The domain was unregistered.
VulnCheck registered it and set up a server capable of speaking the implant’s protocol.
The beacons started arriving.
By August 21, the researchers had observed 392 unique devices connecting to the sinkhole.
Approximately 390 were located in China, with a strong concentration on China Mobile.
That’s a very different view from the 203 Internet-facing DARKLANTERN instances.
One scan shows exposed devices.
The sinkhole shows devices actually reaching an implant’s infrastructure.
Don’t Call Every ZBT Router Compromised
There is an important distinction.
Finding an implant in firmware does not mean every router from the manufacturer is actively controlled by an attacker.
Likewise, the 203 DARKLANTERN devices are devices that answered a probe.
They are not automatically 203 confirmed compromises.
That’s an important line.
Bugstoday should keep it.
The technical finding is already bad enough without exaggeration.
What Should Owners Do?
First:
Find out who actually manufactured the router.
Then check:
model
firmware version
hardware identifiers
and
WAN exposure.
If an affected model is exposed directly to the Internet, treat it as a serious incident.
If there is no verified firmware remediation, replacement is the cleanest option.
And if the router has been used in a sensitive environment, assume credentials and network traffic may require investigation.
Especially:
PPPoE credentials
administrator passwords
DNS configuration
SSH access
and
other secrets stored on the device.
The Bigger Problem
Routers are usually treated as boring infrastructure.
Nobody gets excited about them.
They sit in a rack.
They blink.
They route packets.
And everyone forgets they’re computers.
That’s a mistake.
A router is one of the best places an attacker can compromise because it sits directly in the path of almost everything the network does.
Put a root backdoor there and you don’t just compromise a Linux box.
You potentially compromise the network itself.
Bugstoday Opinion
This is considerably worse than another router CVE.
A vulnerability can be patched.
A misconfiguration can be corrected.
A weak password can be replaced.
But discovering multiple root-capable implants embedded in firmware shipped with networking equipment raises a completely different question:
Who do you trust to build the device sitting between you and the Internet?
DARKLANTERN is particularly ugly because its interface was exposed to the Internet and its authentication could be bypassed.
SPEAKINGSTONE is arguably even more interesting from an intelligence perspective because it can quietly call out to its C2 and operate behind NAT.
And this isn’t a single isolated model.
Researchers identified multiple affected models and white-label products.
Bugstoday verdict: this is what a supply-chain nightmare looks like. The router doesn’t need to be exploited if the backdoor is already inside the firmware. Two newly documented ZBT implants can provide root-level control, 203 DARKLANTERN instances were visible online across 22 countries, and the same manufacturer has already been associated with another implant. Your router isn’t supposed to be the weakest link. It is supposed to be the thing protecting the links.
