The implant beacons hit the sinkhole as soon as we stood it up. Hundreds of routers, almost all in China, beaconing home to a forgotten domain. We found the domain obfuscated in the firmware of a router we bought on Amazon from a small company in New York. Now, we own the domain. We own the implants.

Hunting for ENDLESSDOORS

In our previous blog, “ENDLESSDOORS Is Phoning Home. Pick up,” we detailed a phone-home implant vulnerable to man-in-the-middle attacks embedded in ZBT routers. In this blog, we trace the ZBT supply chain. We got more than we bargained for.

After publishing ENDLESSDOORS, we wanted to know how far ZBT’s supply chain reached. The answer: everywhere. FCC filings, patent records, and archived web pages tied ZBT hardware to brands across the United States, Canada, Australia, the Philippines, Germany, and Russia. We'll trace that supply chain later in this blog. But first, we wanted to know which devices contained the ENDLESSDOORS implant. We started out by buying one router from a US supplier.

The Deep Orange 3G/4G/LTE Router, pictured above, is a white-labeled ZBT-WE826-T2. We exploited a vulnerability in the telnet interface and rooted the device. With root access, we found the router’s firmware was built in 2019, predating ENDLESSDOORS. So ENDLESSDOORS wasn’t there.

Two other implants were.

SPEAKINGSTONE & DARKLANTERN

We found two new implants on the device. SPEAKINGSTONE, like ENDLESSDOORS, is a phone-home implant that connects back to ZBT’s cloud infrastructure and accepts remote commands. DARKLANTERN is a backdoor that listens on the WAN and executes arbitrary commands. No authentication required. Both are written in Nim. Both communicate over UDP. Both are launched by the same binary, a connectivity watchdog called inetdetect.

DARKLANTERN

DARKLANTERN runs as a service called infosrvd, listening on UDP port 9992. The router's default firewall explicitly allows inbound connections to this port from anywhere on the internet. By design, it’s reachable from the outside world.

/tmp # iptables -L udp_packets
Chain udp_packets (1 references)
target     prot opt source               destination         
ACCEPT     udp  --  anywhere             anywhere             udp dpt:9992

The DARKLANTERN protocol, which the binary internally calls "revProto", is simple, unauthenticated, and unencrypted. There are two packet types: an info probe and a command packet.

Info Probe

An info probe is 19 bytes. Send it to UDP/9992 and the device responds back to UDP/8897 with its model, firmware version, MAC address, uptime, and other identifying information. This is the info probe, in its entirety:

0c 16 1f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01

No authentication. No challenge. No session.

Below, a real DARKLANTERN response from a device in Ukraine. The model, MAC address, SSID, and public IP, all in the clear:

\0c\16\1fWE826-T2;19.0617;78a35165f294;733752;;0;0;0;0;0;3835201070;2639069874;;;295428312;5111713550;47586414082;2534543950;192.168.1.1;;_XPAM_;2;;10;;;;;;;2018-11-12;ffff;27199800;45.156.37.159;27028260;0;0;0;0;0

All it takes is 19 bytes for DARKLANTERN to out itself.

Command Packet

A command packet (type 0x17) carries a shell string in the payload. The service passes it directly to system("/etc/exec/cmd " + payload). A semicolon in the payload breaks out of the fixed prefix and executes arbitrary commands. No length limit. No character filtering. One packet for a root shell over the internet.

Two fields gate whether the packet is accepted: the token and the MAC. Both are trivially defeated.

Crafting the Token

Command packets require a four-byte keyed checksum over the payload. The checksum is computed as the last four hex characters of md5("mqonu.com" + payload). The key, "mqonu.com", is hard-coded in the backdoor and therefore unchangeable. Anyone can compute a valid checksum for any payload.

In Python:

import hashlib
token = hashlib.md5(b"mqonu.com" + payload).hexdigest()[-4:].encode()

The key "mqonu.com" appears to reference MoreQuick, the Chinese OEM that developed the firmware for our ZBT-WE826-T2. It’s just a static salt, not a URL that is ever contacted, but it does tie the implant development directly to MoreQuick.

The MAC Filter (And Bypass)

Command packets carry a six-byte MAC address field. The service checks this against the device's own MAC address in /tmp/mac.txt. If it doesn't match, it drops the packet. In theory, at least a reasonable attempt at blocking arbitrary attackers from executing commands (ignore the fact the probe responds with the device's MAC).

Except for one small issue. The code contains a hard-coded bypass. If the MAC field in the command packet is all zeros, the check passes and the packet is queued for processing.

As you can see, there is nothing stopping anyone from sending commands to a DARKLANTERN instance.

Scanning the Internet for DARKLANTERN

Our internet scanner, Target Intelligence, has been probing the internet with DARKLANTERN info probes and getting responses. Because we found no prior public documentation of the backdoor, these responses give us the first public view of DARKLANTERN deployments in the wild.

Between August 18, 2026 and August 21, 2026 we’ve identified 203 internet-facing DARKLANTERN instances across 22 countries.

To reiterate, every one of these devices offers an unauthenticated root shell, reachable from the public internet, protected by a checksum anyone can forge and a MAC filter with an intentional bypass. By design and shipped on ZBT routers.

The scan also reveals that DARKLANTERN is not limited to the ZBT-WE826-T2. The responding devices self-reported 16 different models.

This is not one device with a problem. This is a firmware-level backdoor that was shipped with multiple products. These are older models, and the firmware on our test device was built in 2019. We are likely catching the tail end of DARKLANTERN's deployment. The installed base was almost certainly larger.

SPEAKINGSTONE

SPEAKINGSTONE is different from DARKLANTERN. It doesn't listen for connections. It makes them. Running as a service called yunmgrd, SPEAKINGSTONE beacons outbound over UDP to a command and control server and waits for instructions.

For a remote operator, this is a much better design than a listener. A listener like DARKLANTERN depends on the router being directly reachable from the internet. Put the device behind a firewall, behind NAT, behind a corporate gateway, and the listener is useless. A phone-home implant doesn't care. It connects outbound, like any other internet traffic. It works from anywhere. Behind five firewalls, behind carrier-grade NAT, on a private network. It still works. It still phones home.

On our ZBT-WE826-T2, the configured C2 server is ac-link[.]com. The domain resolves to 47.107.224[.]89, an Alibaba Cloud address in Shenzhen. This is ZBT's domain. The same domain documented in our ENDLESSDOORS research, the same IP address hardcoded into an ENDLESSDOORS init script. ZBT's cloud infrastructure is the command and control server for this implant.

The ZBT Protocol

SPEAKINGSTONE uses a UDP-based protocol that the binary calls "zbtProtocol." The implant beacons out to the configured C2 server on UDP port 10000. The beacon contains the device's model, firmware version, MAC address, SSID, LAN IP, uptime, and more. It’s a full device fingerprint.

The wire format:

On our WE826-T2, outbound messages are XOR-obfuscated with a single byte (0x1f). As we'll show later, not all devices do this, suggesting the obfuscation is either optional or was added later. Inbound commands from the C2 are always plaintext. No encryption. No authentication. The device has no way to verify it is talking to a legitimate server. Anyone on the network path can hijack these implants.

The registration beacon (msgType 0x1001) is sent on a regular interval. It contains the full contents of /tmp/info.txt: model, firmware version, MAC, uptime, SSID, LAN IP, GPS coordinates, and more. The C2 replies to this beacon with commands.

This implant has more features than DARKLANTERN or ENDLESSDOORS. In many ways, it’s a significantly more capable implant than either. The SPEAKINGSTONE protocol supports these message types:

In response to ENDLESSDOORS, ZBT stated that the implant was an "after-sales technical support tool." No one is mistaking SPEAKINGSTONE for a customer support tool. It’s not a cloud management tool. Those types of tools don't steal ISP credentials. They don't hijack DNS. This is a surveillance implant with root access to every device it runs on.

The Forgotten Domain

SPEAKINGSTONE has a hardcoded backup C2 domain. If no primary C2 is configured, the implant defaults to www.findmyipaddr[.]com. This is not a failover. If ac-link[.]com is configured but unreachable, the implant does not fall back. It just waits. Any device that reaches for the backup domain was never configured with a primary C2 in the first place.

The backup domain is obfuscated in the yunmgrd binary, split into fragments: "ww"+"w.f"+"indmy"+"ipadd"+"r.co"+"m". Essentially, a basic attempt to hide it from string searches.

At the time of our analysis, findmyipaddr[.]com was not registered. Nobody owned it.

We registered it.

The Sinkhole

We registered the domain and stood up a server running a reverse-engineered implementation of zbtProtocol. This is called sinkholing: when a researcher takes control of an abandoned command and control domain, every device that phones home to it connects to the researcher instead. The beacons started arriving immediately. Each one a full device fingerprint: model, firmware, MAC, SSID, uptime, IP address.

As of August 21, 2026, 392 unique devices have reported in. Collection is ongoing. 390 are in China. The longest-running device has been beaconing for nearly two years without interruption.

390 of 392 devices are in China. 83% are on China Mobile's network. 304 broadcast SSIDs beginning with "CMCC," China Mobile's consumer branding.

363 of 392 are a single model: L3_V2_8, running firmware 3.0.0.4.528. This is not a router you buy off a shelf. It appears to be a carrier CPE, deployed on China Mobile's network. Same model. Same firmware. Same carrier. Same country.

This is domestic Chinese surveillance technology. It was deployed inside China, on Chinese networks, at scale.

The same implants are running on routers sold to Americans through Amazon.

And these are only the devices reaching the backup domain. The primary C2, ac-link[.]com, is still live. The full population of SPEAKINGSTONE-equipped devices is unknown and almost certainly much larger.

Following the ZBT Supply Chain

Everything documented above was found on a single $88 router, sold by a small company in New York. Deep Orange didn't build it. They white-labeled it. The sticker on the bottom of the router labels it a WE826-T. That matches a router model in a Shenzhen Zhibotong Electronics (ZBT) FCC filing. The routers look exactly alike too. And if there was any doubt, the Deep Orange device uses a MAC address starting with 78:A3:51, a block allocated to ZBT. The router inherited the implants through the ZBT supply chain.

Shenzhen Zhibotong Electronics is not known as a consumer brand. Mostly, it manufactures devices that other companies sell under different names. This section of the blog aims to surface some of the brands that resell ZBT hardware and highlight how one relatively obscure manufacturer in China can have a global reach. Wherever ZBT's hardware goes, its firmware and implants can follow.

The Proliferation of the ZBT-WE826

What makes the ZBT-WE826 appealing is its cellular connectivity. Insert a SIM card, and it can provide internet access almost anywhere: oil pipelines, roadside billboards, trains, or even an RV. The 4G LTE connection can also serve as a failover, providing a redundant path when the primary internet connection goes down. That’s useful at a point of sale or any other critical juncture where losing connectivity could mean loss of life or, even worse, loss of revenue.

Due to its usefulness and low cost, it’s not surprising the device has been relabeled around the globe. In the United States, the platform found its way into products aimed at people on the move, including Lippert Components WiFi On-The-Go and Wave WiFi’s MBR 500/550 series.

Australia’s OneX rebrands the ZBT-WE826 as the RV WIFI Route. In Canada, MOFI Network sold the MOFI4500-4GXeLTE, and its FCC filing includes a schematic titled ZBT-WE826. The router’s MAC address also falls within Zhibotong’s 78:A3:51 address block. The pattern is hard to miss: the same ZBT platform shows up under different names, in different countries, and for different use cases.

That isn’t to say all of these contain ENDLESSDOORS, DARKLANTERN, or SPEAKINGSTONE. Hopefully, they don’t. MOFI, for example, develops custom firmware, and the MOFI firmware we examined didn’t contain any implants. The point is this: just because you’ve never heard of Shenzhen Zhibotong Electronics or the ZBT-WE826 doesn’t mean you haven’t interacted with one.

Due to its age, the WE826 is the clearest example, but it isn’t the only ZBT platform surfacing under independent Western names. Germany’s Digineo sold a router named AC1200 Pro built on ZBT’s WG3526 platform. Another German vendor, ALLNET, sold the ALL-WR1200AC-WRT, which OpenWrt identifies as an OEM version of ZBT’s WG2626 platform.

Brands Closer to ZBT

So far, we’ve looked at independent companies selling ZBT hardware under their own name. The brands that follow are different. The closer we looked, the harder it became to tell where ZBT ended and the retail brand began.

Take WiFlyer. According to the USPTO, Shenzhen Zhibotong Electronics owns the WiFlyer trademark. WiFlyer routers are not ZBT-derived. They are ZBT, sold in the United States through Amazon and Newegg. ZBT also registered WORDFI and HomeMyfi with the USPTO. WORDFI appears primarily in the Philippines through Shopee, while HomeMyfi appears unused.

Cioswi is a little older and a little stranger. Its now-defunct website, cswlink.com, tightly linked the brand to ZBT: an archived support page directs users to sales03@zbt-china.com. The brand remains active today, including through an AliExpress storefront featuring both English and Cyrillic text, suggesting it is marketed to Russian-speaking customers. The brand also maintains a quieter Amazon storefront.

CroSkylink is harder to link organizationally, but much easier to recognize. Below are the Zbtlink Z8102AX-T and CroSkylink CS-Z8102AX-M2-T. They appear to be the same router under different branding. CroSkylink even offers “European” and “Global” versions.

KuWFi is similar, although its catalog appears to mix hardware from multiple manufacturers. Some products are unmistakably ZBT platforms. The KuWFi WG3526, for example, is the same platform sold as the WiFlyer WG3526 and Zbtlink WG3526.

At this point, the branding starts to feel almost incidental. Some of these companies are independent, some are closely tied to ZBT, and some simply appear to resell the same platforms under different names. The common thread is that ZBT hardware keeps surfacing in places where the buyer may never encounter the ZBT name at all.

Conclusion

The ZBT response to ENDLESSDOORS was to state "it is intended to assist customers with device troubleshooting and configuration only upon their explicit request and authorization." That is a difficult claim to maintain. We found no mechanism for a customer to explicitly request or authorize access. ENDLESSDOORS was designed like an implant, and some variants relied on dynamic DNS providers like wikaba, infrastructure more commonly associated with malware than legitimate customer support. That defense was strained for one implant. We have now found three.

ZBT also stated "this component has never been used for unauthorized access." Even if we take them at their word, the statement is meaningless. None of these implants support secure communications. Anyone on the network path can hijack ENDLESSDOORS or SPEAKINGSTONE. We proved it: we registered a SPEAKINGSTONE backup domain and hundreds of devices reported in. DARKLANTERN only required figuring out a static key. ZBT cannot know whether these implants have been used for unauthorized access because access to them is not under ZBT’s control.

This is now three sets of implants across multiple ZBT firmware generations. ENDLESSDOORS. SPEAKINGSTONE. DARKLANTERN. The supply chain reaches the United States, Canada, Australia, the Philippines, Germany, and Russia. We see systems in Israel, Ukraine, China, Hong Kong, Turkey, and Taiwan. The hardware can ship under brands that give no indication of its origin. Not all of them carry the implants. Some do and that is too many.

Consider what these implants enable. An operator with SPEAKINGSTONE access can redirect a router's DNS, sending every device on the network to attacker-controlled servers. They can steal the ISP credentials that authenticate the connection. They can open a reverse SSH tunnel and log in directly. They can do all of this silently, remotely, and to any device that phones home.

These devices do not belong on American networks. They are routers with built-in surveillance capabilities, manufactured in China, sold to unsuspecting consumers, with backdoors that are trivially exploitable by any attacker who finds them. They are not theoretical risks or silly vulnerabilities. They are real documented implants. We have the beacons. We have the scans. We have root.

Appendix

File Hashes

ASM Fingerprints

Observed Affected Models

The following tables contain affected models and firmware versions we observed in the wild.

Affected DARKLANTERN (Self-Reported)

Affected SPEAKINGSTONE (Self-Reported)

Domains

Suricata Rules

alert udp any any -> any 9992 ( \
    msg:"VULNCHECK Zbt/MoreQuick DARKLANTERN Wildcard-MAC Root Command Execution"; \
    dsize:>27; content:"|0c 17 1f 12 34 56 00 00 00 00 00 00|"; offset:0; depth:12; \
    pcre:"/^\x0c\x17\x1f\x12\x34\x56\x00{6}[0-9a-f]{4}.{2}[\x20-\x7e]{10}/s"; \
    xbits:set,darklantern.cmd_injected,track ip_pair,expire 120; \
    classtype:attempted-admin; sid:12800030; rev:1; \
    metadata: deployment Datacenter, impact compromised;)

alert udp any any -> any 9992 ( \
    msg:"VULNCHECK Zbt/MoreQuick DARKLANTERN Info Probe"; \
    dsize:19; content:"|0c 16 1f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01|"; offset:0; depth:18; \
    classtype:attempted-recon; sid:12800031; rev:1; \
    metadata: deployment Datacenter;)

alert udp any 9992 -> any 8898 ( \
    msg:"VULNCHECK Zbt/MoreQuick DARKLANTERN Command Output Exfil"; \
    content:"|0c 17 1f|"; offset:0; depth:3; \
    xbits:isset,darklantern.cmd_injected,track ip_pair; \
    classtype:successful-admin; sid:12800032; rev:1; \
    metadata: deployment Datacenter, impact compromised;)

alert dns any any -> any any ( \
    msg:"VULNCHECK Zbtlink Router SPEAKINGSTONE C2 Domain Lookup (www.ac-link.com)"; \
    dns.query; content:"www.ac-link.com"; nocase; \
    pcre:"/^www\.ac-link\.com$/i"; \
    classtype:trojan-activity; \
    sid:12800020; rev:1; \
    metadata: deployment Datacenter, impact compromised;)

alert dns any any -> any any ( \
    msg:"VULNCHECK Zbtlink Router SPEAKINGSTONE C2 Domain Lookup (www.findmyipaddr.com)"; \
    dns.query; content:"www.findmyipaddr.com"; nocase; \
    pcre:"/^www\.findmyipaddr\.com$/i"; \
    classtype:trojan-activity; \
    sid:12800021; rev:1; \
    metadata: deployment Datacenter, impact compromised;)

alert udp $HOME_NET any -> any 10000 ( \
    msg:"VULNCHECK Zbtlink Router SPEAKINGSTONE zbtProtocol reg Beacon"; \
    dsize:>60; \
    content:"|00 00 00 00|"; offset:9; depth:4; \
    content:"|10 01|"; distance:4; within:2; \
    byte_jump:2,0,big,from_beginning,post_offset 2; \
    isdataat:!1,relative; \
    classtype:trojan-activity; \
    sid:12800022; rev:2; \
    metadata: deployment Datacenter, impact compromised;)

alert udp any 10000 -> $HOME_NET any ( \
    msg:"VULNCHECK Zbtlink Router SPEAKINGSTONE zbtProtocol Command Injection"; \
    dsize:>21; \
    content:"|78 22 3b|"; fast_pattern; \
    content:"|00 00 00 00|"; offset:9; depth:4; \
    content:"|25 07|"; distance:4; within:2; \
    content:"|78 22 3b|"; distance:0; within:3; \
    byte_jump:2,0,big,from_beginning,post_offset 2; \
    isdataat:!1,relative; \
    classtype:trojan-activity; \
    sid:12800023; rev:2; \
    metadata: deployment Datacenter, impact compromised;)

alert udp any 10000 -> $HOME_NET any ( \
    msg:"VULNCHECK Zbtlink Router SPEAKINGSTONE zbtProtocol Credential/Hijack Op"; \
    dsize:>18; \
    content:"|00 00 00 00|"; offset:9; depth:4; \
    pcre:"/^.{9}\x00{4}.{4}(\x25\x02|\x23\x0b)/s"; \
    byte_jump:2,0,big,from_beginning,post_offset 2; \
    isdataat:!1,relative; \
    classtype:trojan-activity; \
    sid:12800024; rev:2; \
    metadata: deployment Datacenter, impact compromised;)

YARA

rule Zbtlink_Router_SPEAKINGSTONE_Implant
{
  meta:
    description = "MoreQuick/Zbtlink yunmgrd cloud-C2 implant (SPEAKINGSTONE): /usr/bin/yunmgrd Nim ELF. Plaintext, unauthenticated zbtProtocol C2 over UDP/10000 to ac-link.com / findmyipaddr.com, with cmdRun -> /etc/exec/cmd root exec, DNS hijack, and PPPoE credential exfil. MIPS/uClibc build."
    author = "vulncheck"

  strings:
    $proto = "zbtProtocol.c" ascii
    $run   = "zbt protocol running" ascii
    $conf  = "/tmp/yunclient.conf" ascii
    $cmcc  = "cmcc_server" ascii
    $dns   = "dnshack" ascii
    $cmd   = "/etc/exec/cmd" ascii
    $back  = "setBackServer" ascii
    $reg   = "regMsg" ascii

  condition:
    uint32(0) == 0x464C457F and 4 of them
}

rule Zbtlink_Router_DARKLANTERN_Implant
{
  meta:
    description = "MoreQuick/Zbtlink infosrvd backdoor (DARKLANTERN): /usr/bin/infosrvd Nim ELF. Unauthenticated UDP/9992 info/cmd service with root command execution via /etc/exec/cmd. MIPS/uClibc build."
    author = "vulncheck"

  strings:
    $cmd     = "/etc/exec/cmd " ascii
    $sysinfo = "/etc/exec/sysinfo" ascii
    $cmdlog  = "/tmp/cmd.log" ascii
    $infotxt = "/tmp/info.txt" ascii
    $local   = "startlocalserve" ascii
    $salt    = "Salt_171006_808290505" ascii
    $allmac   = "Allmac_171007_808290505" ascii
    $validpkt = "invalid request pkt" ascii
    $shell   = "nosexecShellCmd" ascii

  condition:
    uint32(0) == 0x464C457F and 2 of ($salt, $allmac, $local, $validpkt) and 3 of ($cmd, $sysinfo, $cmdlog, $infotxt, $shell)
}

Minimal DARKLANTERN Scanner

#!/usr/bin/env python3
"""Minimal DARKLANTERN scanner"""

import socket
import sys

# info probe: type 0x16, wildcard Allmac (all zeros), 1-byte dummy payload "x"
PROBE = b"\x0c\x16\x1f" + b"\x00" * 12 + b"\x00\x01x"

def scan(host, port=9992, timeout=6):
    sock = socket.socket(socket.AF_INET, socket.SOCK_DGRAM)
    sock.settimeout(timeout)
    # infosrvd replies to :8897, not our source port — bind explicitly
    sock.bind(("", 8897))
    try:
        sock.sendto(PROBE, (host, port))
        data, _ = sock.recvfrom(1024)
    except socket.timeout:
        return None
    finally:
        sock.close()

    if len(data) < 4 or data[:3] != b"\x0c\x16\x1f":
        return None

    fields = data[3:].decode("ascii", errors="replace").split(";")
    if len(fields) < 3:
        return None

    return {"model": fields[0], "firmware": fields[1], "mac": fields[2]}

if __name__ == "__main__":
    if len(sys.argv) != 2:
        print(f"usage: {sys.argv[0]} <host>", file=sys.stderr)
        sys.exit(1)

    result = scan(sys.argv[1])
    if result:
        print(f"[VULN] {sys.argv[1]} — model={result['model']} fw={result['firmware']} mac={result['mac']}")
    else:
        print(f"[SAFE] {sys.argv[1]} — no infosrvd response")

About VulnCheck

VulnCheck’s research team tracks real-world exploitation, attacker infrastructure, and exploit workflows using our Canary Intelligence, Exploit & Vulnerability Intelligence (EVI), and IP Intelligence datasets. For more research like this check out our blogs, Frost Checks First, The Mystery OAST Host Behind a Regionally Focused Exploit Operation, and XWiki Under Increased Attack.

Sign up for the VulnCheck community today to get free access to our VulnCheck KEV, enjoy our comprehensive vulnerability data, and request a trial of our Initial Access Intelligence, Target Intelligence, Canary Intelligence, and Exploit & Vulnerability Intelligence products.