Surveillance Implants Found in Chinese-Made Routers Worldwide
Three backdoor-like implants have been discovered hidden in firmware for routers manufactured by Shenzhen Zhibotong Electronics ZBT, a company that sells hardware under dozens of brands worldwide. The research, published by security firm VulnCheck, reveals that these implants range from remote-control systems to sophisticated spying tools capable of compromising home and business networks. This investigation highlights fundamental supply-chain security weaknesses that affect the global routing infrastructure.
ENDLESSDOORS: Remote-Control System
The first implant dubbed ENDLESSDOORS was discovered in a Zbtlink AX3000 router. Researchers found that its firmware contained an implant that automatically phones home to a command-and-control server and can execute arbitrary commands as root. ENDLESSDOORS disguises itself as a normal Linux kernel process called kworker making it difficult to detect for casual inspection. The router periodically connects to a hard-coded server and announces itself without meaningful authentication or encryption. Commands received from the server are passed directly to a shell running as root and the implant can also establish an interactive root shell.
VulnCheck demonstrated the problem by impersonating the command server and taking control of its own test router. In other words this isnt merely a theoretical vulnerability if an attacker can hijack the connection to the implants command server they can obtain complete control of the router. The researchers found ENDLESSDOORS embedded in firmware for 20 ZBT models including the Z8102AX WG3526 WE826-T3-DSIM and several other cellular routers. The same hardware is also sold under other names because ZBT manufactures routers for OEM and ODM customers. VulnCheck assigned the issue CVE-2026-66747 with a CVSS score of 9.3, indicating critical severity. That score reflects both the ease of exploitation and the damage a successful attacker can do to a network built around these devices.
DARKLANTERN: WAN Listener
The second implant DARKLANTERN operates as an infosrvd service that opens a listener on the WAN via UDP port 9992 and accepts commands directly from the Internet without authentication. An attacker only needs to send a fixed 19-byte info probe to force the router to reveal identifying information like its model firmware version MAC address and uptime. Researchers found that the backdoors meager security mechanisms could be trivially bypassed: its command payload checksum relies on a static hardcoded salt mqonu.com and its internal MAC address filter can be entirely circumvented by submitting a MAC field of all zeroes. This allows any remote attacker to easily forge a packet and execute arbitrary commands as root. VulnCheck scanned the Internet and found 203 exposed DARKLANTERN instances in 22 countries spread across 16 router models. The widespread distribution suggests this implant has been deployed in diverse network environments across multiple continents over a long period.
SPEAKINGSTONE: Beaconing Backdoor
VulnCheck researchers also discovered SPEAKINGSTONE a third and even more concerning implant that runs as the yunmgrd service and periodically beacons outbound to ZBTs command-and-control infrastructure over UDP port 10000. That makes it useful even when the router sits securely behind NAT or a firewall as it relies on a custom format dubbed zbtProtocol to push full device fingerprints directly to the remote server. SPEAKINGSTONE is also considerably more capable than simply providing a remote shell. According to VulnCheck its command protocol allows remote attackers to push commands that can move laterally across networks and establish persistent footholds. The researchers found that SPEAKINGSTONE is particularly useful for launching distributed denial-of-service attacks crippling target networks with coordinated traffic floods. The implants ability to operate behind NAT makes it especially dangerous for home users and small businesses who may not deploy advanced network monitoring.
Chinese Deployment Findings
The implications are far-reaching because ZBT manufactures routers for OEM and ODM customers the affected hardware is sold under many different brand names meaning you may not even realize youre using a ZBT router when you purchase a device from a major vendor. VulnCheck scanned the Internet and found hundreds of exposed instances across 22 countries indicating this is not an isolated problem but a widespread supply-chain security issue.
Particularly concerning is the finding that by August 21st 392 unique devices had connected to the sinkhole that researchers set up to monitor SPEAKINGSTONE communications. Fully 390 of those 392 were located in China with the vast majority using China Mobile's network. Most of those devices were the same router model running the same firmware suggesting a large-scale carrier deployment rather than random consumer infections. VulnCheck describes this particular deployment as domestic Chinese surveillance technology.
VulnCheck explicitly notes that not every ZBT router is compromised. The firm found ZBT hardware being sold under numerous independent brands worldwide including Lippert Components Wave WiFi OneX in Australia MoFI Network in Canada Digineo in Germany and more. Some of the firmware examined did not contain the implants. The problem is that ZBT's OEM business makes the hardware's origin surprisingly difficult to identify. The same underlying platforms have appeared under brands including WiFlyer Deep Orange Cioswi CroSkylink and KuWFi among others.
ZBT has described ENDLESSDOORS as an after-sales technical-support mechanism. But the firm's counterargument is compelling; whatever its intended purpose the mechanisms don't securely authenticate the party controlling them. An attacker who can hijack the communications can potentially exercise the same privileges and because ZBT hardware is frequently sold under other brands simply not buying something with ZBT printed on the box isnt necessarily enough.
A Pattern of Embedded Access
The ZBT findings are not the first time researchers have found deliberately planted access in consumer network gear. Supply-chain attacks on routers have become a recurring theme in security research. In past years investigators have found backdoors in wiring produced by other Chinese manufacturers and in devices sold through major ecommerce marketplaces. What makes the ZBT case stand out is the scale: the same platform family spans dozens of brands across at least five continents, and the implants include both inbound listeners and outbound beacons. That combination lets whoever controls the command infrastructure reach devices that sit behind firewalls.
There is also a practical lesson for enterprise security teams. Asset inventories usually track the brand and model of every router on the network, but they rarely track who actually wrote the firmware. When a device is white-labeled, the brand on the box tells you almost nothing about the code inside. Teams that manage cellular routers at remote sites, travel routers for field staff, or RV routers at seasonal locations should treat those devices as untrusted until proven otherwise. The same caution applies to any cheap networking hardware purchased from online marketplaces where OEM sourcing is rarely disclosed.
The incident also raises questions about how consumers worldwide evaluate the trustworthiness of low-cost networking gear. Price competition in the consumer router market has pushed many vendors toward white-label manufacturing. The buyer sees a logo and a warranty; the supply chain behind it can be opaque. Security researchers have repeatedly warned that firmware audits are rare in this segment and that economic incentives favor shipping features over verifying code provenance.
Protection and Mitigation
- Identify your router model and manufacturer cross-referencing with VulnCheck's public vulnerability lists
- Check for firmware updates from the vendors website and apply them promptly
- Consider replacing older routers that no longer receive regular security updates
- Monitor network traffic for unusual outbound connections from routers particularly on ports 9992 and 10000 which may indicate compromise
- Use a firewall to restrict inbound and outbound traffic to trusted sources only
- For enterprise networks conduct regular asset inventory to identify all routing devices and their origins
- Ask vendors directly about their OEM suppliers when buying networking gear in bulk
The discovery of these three implants highlights the ongoing risks in the global router supply chain and the importance of vigilance in maintaining network security. Users and administrators should not assume that the brand name on a device reflects the true firmware origin or security posture. For more coverage of network security threats and responses, see the Cybersecurity category on this site, which tracks similar supply-chain compromises and government advisories.