ZBT: Three Implants, One Supply Chain, and 392 Devices Calling a Forgotten Domain
Summary
VulnCheck bought an $88 router on Amazon from a small company in New York. The label said Deep Orange. Underneath the shell was a ZBT-WE826-T2 from Shenzhen Zhibotong Electronics, and inside the firmware were two previously undocumented implants.
This is not a software vulnerability. This is code that shipped by design:
DARKLANTERN (service
infosrvd) — a backdoor listening on UDP/9992 that executes arbitrary commands as root, with no authentication. The router's default firewall explicitly allows inbound connections to this port from anywhere on the internet.SPEAKINGSTONE (service
yunmgrd) — a phone-home implant beaconing out over UDP/10000, supporting DNS hijacking, PPPoE credential theft, and reverse SSH tunnels. Both are written in Nim, both communicate over UDP, and both are launched by the same connectivity watchdog binary,inetdetect.
VulnCheck found that SPEAKINGSTONE carries a backup C2 domain that nobody had registered. They registered it. The beacons arrived immediately: 392 devices, 390 of them in China, 83% on China Mobile's network, with the longest-running device beaconing continuously for nearly two years.
Priority action: check whether your organisation has any network device with a MAC address beginning 78:A3:51 — that is the OUI block allocated to ZBT, and the fastest way to recognise ZBT hardware under any brand label.
Background and Timeline
These are the second and third implants discovered from the same manufacturer, across multiple firmware generations.
| Date | Event |
|---|---|
| 5 Aug 2026 | VulnCheck publishes ENDLESSDOORS — the first phone-home implant found in ZBT firmware |
| 6 Aug 2026 | ZBT announces it has suspended sales of the affected models and removed the relevant firmware from its official website |
| 18–21 Aug 2026 | VulnCheck scans the internet with DARKLANTERN info probes, identifying 203 instances across 22 countries |
| 21 Aug 2026 | The SPEAKINGSTONE sinkhole records 392 devices reporting in |
| 27 Aug 2026 | VulnCheck publishes DARKLANTERN and SPEAKINGSTONE, with two CVEs |
Two CVEs were assigned, both CVSS 9.3 (Critical) and both already in VulnCheck KEV:
| CVE | Implant | Classification |
|---|---|---|
| CVE-2026-74233 | DARKLANTERN (infosrvd) |
CWE-321 Hard-coded Cryptographic Key + CWE-78 OS Command Injection |
| CVE-2026-74232 | SPEAKINGSTONE (yunmgrd) |
CWE-506 Embedded Malicious Code + CWE-300 Channel Accessible by Non-Endpoint |
Worth noting on classification: CWE-506 means "Embedded Malicious Code". That is not how a CVE-assigning organisation describes a programming mistake.
The relationship between SPEAKINGSTONE, DARKLANTERN and their shared launcher inetdetect (source: VulnCheck).
DARKLANTERN: A Backdoor Exposed to the Internet by Default
DARKLANTERN runs as a service called infosrvd, listening on UDP port 9992.
The part to read closely is the router's own default firewall:
/tmp # iptables -L udp_packets
Chain udp_packets (1 references)
target prot opt source destination
ACCEPT udp -- anywhere anywhere udp dpt:9992
This rule permits inbound connections to port 9992 from anywhere on the internet. VulnCheck states it plainly: by design, it is reachable from the outside world.
This is not a user misconfiguration. This is the factory configuration.
The protocol, which the binary internally calls revProto, is simple, unauthenticated and unencrypted. There are two packet types.
Info Probe: 19 Bytes to Expose the Whole Device
An info probe is 19 bytes. Send it to UDP/9992 and the device responds back to UDP/8897 with its model, firmware version, MAC address, uptime and other identifying information.
0c 16 1f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01
No authentication. No challenge. No session.
This is a real response VulnCheck captured from a device in Ukraine — model, MAC, SSID and public IP all in the clear:
\0c\16\1fWE826-T2;19.0617;78a35165f294;733752;;0;0;0;0;0;3835201070;2639069874;;;
295428312;5111713550;47586414082;2534543950;192.168.1.1;;_XPAM_;2;;10;;;;;;;
2018-11-12;ffff;27199800;45.156.37.159;27028260;0;0;0;0;0
Command Packet: One UDP Packet Is a Root Shell
A command packet (type 0x17) carries a shell string in its payload. The service passes it directly to system("/etc/exec/cmd " + payload).
A semicolon in the payload breaks out of the fixed prefix and executes arbitrary commands. No length limit. No character filtering.
The DARKLANTERN command packet format (source: VulnCheck).
Two fields gate whether a packet is accepted — and both are trivially defeated.
The token. Command packets require a four-byte keyed checksum, computed as the last four hex characters of md5("mqonu.com" + payload). The key "mqonu.com" is hard-coded in the backdoor and therefore unchangeable. Anyone can compute a valid checksum for any payload:
import hashlib
token = hashlib.md5(b"mqonu.com" + payload).hexdigest()[-4:].encode()
The string mqonu.com is never contacted as a URL — it is only a static salt. But it references MoreQuick, the Chinese OEM that developed the firmware for the ZBT-WE826-T2, and therefore ties implant development directly to MoreQuick.
The MAC filter — and its built-in bypass. Command packets carry a six-byte MAC address field, checked against the device's own MAC in /tmp/mac.txt. A mismatch drops the packet. In theory that is at least a reasonable attempt at blocking arbitrary attackers — ignoring the fact that the info probe already returns the device's MAC.
Except for one thing: the code contains a hard-coded bypass. If the MAC field is all zeros, the check passes and the packet is queued for processing.
This is the detail I consider most significant in the DARKLANTERN analysis. A logic error in a MAC check could be an oversight. A dedicated branch handling an all-zero value, written into the code, is not.
Scale on the Internet
Distribution of internet-facing DARKLANTERN instances (source: VulnCheck).
Between 18 and 21 August 2026, VulnCheck identified 203 internet-facing DARKLANTERN instances across 22 countries.
Every one of those devices offers an unauthenticated root shell, reachable from the public internet, protected by a checksum anyone can forge and a MAC filter with an intentional bypass.
Sixteen self-reported models in the scan data (source: VulnCheck).
The scan also shows DARKLANTERN is not limited to the ZBT-WE826-T2: responding devices self-reported 16 different models. This is not one product with a problem — it is a firmware-level backdoor shipped with multiple products.
VulnCheck adds that these are older models, and the firmware on their test device was built in 2019 — they are likely catching the tail end of DARKLANTERN's deployment, and the installed base was almost certainly larger.
SPEAKINGSTONE: The Considerably More Capable Implant
SPEAKINGSTONE differs from DARKLANTERN in a fundamental way: it does not listen for connections, it makes them.
VulnCheck explains why this is a much better design for a remote operator. A listener like DARKLANTERN depends on the router being directly reachable from the internet — put the device behind a firewall, behind NAT, behind a corporate gateway, and the listener is useless. A phone-home implant does not care: it connects outbound, like any other internet traffic. Behind five firewalls, behind carrier-grade NAT, on a private network — it still works.
The primary C2 on the test device is ac-link[.]com, resolving to 47.107.224[.]89, an Alibaba Cloud address in Shenzhen. This is ZBT's own domain, and the same domain documented in the ENDLESSDOORS research, with the same IP hard-coded into an ENDLESSDOORS init script.
The zbtProtocol
The implant beacons to C2 on UDP port 10000. The beacon carries a full device fingerprint: model, firmware version, MAC, SSID, LAN IP, uptime, GPS coordinates, and the entire contents of /tmp/info.txt.
The SPEAKINGSTONE beacon wire format (source: VulnCheck).
On protection: on the WE826-T2, outbound messages are obfuscated with a single-byte XOR (0x1f) — but not all devices do this, suggesting the obfuscation is optional or was added later. Inbound commands from the C2 are always plaintext.
No encryption. No authentication. The device has no way to verify it is talking to a legitimate server. Anyone on the network path can hijack these implants.
Command Set
| msgType | Name | Effect |
|---|---|---|
0x1001 |
reg | Device fingerprint beacon |
0x2507 |
cmdRun | Execute arbitrary commands |
0x2502 |
pppoe | Exfiltrate the WAN PPPoE username and password |
0x230b |
dnsSet | Write a DNS hijack list, activated via /usr/sbin/dns.sh |
0x2306 |
dnsGet | Return the current DNS hijack list |
0x2405 |
onoff | Open or close a reverse SSH tunnel |
0x2406 |
sshport | Return the current reverse SSH port |
0x2602 |
setBackup | Update backup C2 server addresses |
In response to ENDLESSDOORS, ZBT stated that implant was an "after-sales technical support tool." VulnCheck's comment on SPEAKINGSTONE is direct: customer support tools do not steal ISP credentials, and they do not hijack DNS.
The Sinkhole: 392 Devices and One Model
SPEAKINGSTONE carries a hard-coded backup C2 domain: www.findmyipaddr[.]com. This is not a failover — if ac-link[.]com is configured but unreachable, the implant does not fall back, it simply waits. Any device that reaches for the backup domain was never configured with a primary C2 in the first place.
The domain is obfuscated in the yunmgrd binary by string splitting: "ww"+"w.f"+"indmy"+"ipadd"+"r.co"+"m" — a basic attempt to hide it from string searches.
The split domain string in the binary (source: VulnCheck).
At the time of analysis, findmyipaddr[.]com was not registered. VulnCheck registered it and stood up a server running a reverse-engineered implementation of zbtProtocol.
The SPEAKINGSTONE sinkhole workflow (source: VulnCheck).
The beacons started arriving immediately. As of 21 August 2026:
| Metric | Value |
|---|---|
| Devices reporting in | 392 (collection ongoing) |
| Located in China | 390 / 392 |
| On China Mobile's network | 83% |
| Broadcasting SSIDs beginning "CMCC" | 304 |
| Model L3_V2_8, firmware 3.0.0.4.528 | 363 / 392 |
| Longest continuous beaconing | nearly two years |
Carrier distribution of the devices reporting to the sinkhole (source: VulnCheck).
VulnCheck assesses that L3_V2_8 is not a router you buy off a shelf but a carrier CPE deployed on China Mobile's network. Same model, same firmware, same carrier, same country.
Their conclusion: this is domestic Chinese surveillance technology, deployed inside China, on Chinese networks, at scale — and the same implants are running on routers sold to Americans through Amazon.
An important caveat on that number: 392 covers only devices reaching the backup domain, meaning devices never configured with a primary C2. ac-link[.]com is still live. The full population of SPEAKINGSTONE-equipped devices is unknown and almost certainly much larger.
The Supply Chain: Where the Hardware Goes, the Firmware Follows
Everything above was found on a single $88 router, sold by a small company in New York. Deep Orange did not build it — they white-labelled it.
The bottom label reads WE826, matching a ZBT FCC filing (source: VulnCheck).
Three independent pieces of evidence tie the device to ZBT: the bottom sticker labels it a WE826, matching a Shenzhen Zhibotong Electronics FCC filing; the routers look identical; and the MAC address begins with 78:A3:51, a block allocated to ZBT.
Shenzhen Zhibotong Electronics is not known as a consumer brand. Mostly it manufactures devices that other companies sell under different names. VulnCheck traced the chain through FCC filings, patent records and archived web pages, finding ZBT hardware under brands in the United States, Canada, Australia, the Philippines, Germany and Russia.
Some representative examples:
| Brand | Market | Evidence of ZBT connection |
|---|---|---|
| Deep Orange | US (Amazon) | WE826-T FCC filing; MAC OUI 78:A3:51 |
| WiFlyer | US (Amazon, Newegg) | ZBT owns the trademark per USPTO records — these are not ZBT-derived, they are ZBT |
| WORDFI | Philippines (Shopee) | Trademark registered with USPTO by ZBT |
| Cioswi | Russia (AliExpress), US (Amazon) | Archived support page directs users to sales03@zbt-china.com |
| MOFI4500-4GXeLTE | Canada | FCC filing includes a schematic titled "ZBT-WE826"; matching MAC OUI |
| Digineo AC1200 Pro / ALLNET | Germany | Built on the WG3526 and WG2626 platforms (OpenWrt identifies the latter) |
| Lippert WiFi On-The-Go / Wave WiFi MBR | US | WE826 platform, aimed at RVs and boats |
| OneX RV WIFI Route | Australia | Rebranded WE826 |
The same ZBT hardware appearing under three different brand names (source: VulnCheck).
One important point to preserve for fairness: VulnCheck states clearly that not all of these contain the implants. MOFI develops custom firmware, and the MOFI firmware they examined contained no implants.
ZBT hardware does not automatically mean an implant. The firmware is what decides. The problem is that buyers usually have no way of knowing where the firmware on their device came from.
The conclusion VulnCheck draws, and it is the right one: just because you have never heard of Shenzhen Zhibotong Electronics or the ZBT-WE826 does not mean you have never interacted with one.
ZBT's Response, and VulnCheck's Rebuttal
Following the ENDLESSDOORS disclosure, ZBT published an official statement on its website. The substance:
The remote management component mentioned in the report serves solely as an after-sales technical support tool, intended to assist customers with device troubleshooting and configuration only upon their explicit request and authorization.
This component has never been used for unauthorized access.
Measures taken: sales of affected models immediately suspended, downloads of the relevant firmware removed from the official website, with firmware updates in development. VulnCheck's rebuttal has three parts, and I find it well-founded:
No mechanism for request or authorization was found. VulnCheck states they found no mechanism by which a customer could explicitly request or authorize access. ENDLESSDOORS was designed like an implant, and some variants relied on dynamic DNS providers — infrastructure more commonly associated with malware than with legitimate customer support.
The "never used for unauthorized access" claim is logically meaningless. None of the three implants support secure communications. Anyone on the network path can hijack ENDLESSDOORS or SPEAKINGSTONE. ZBT cannot know whether these implants have been used for unauthorized access, because access to them is not under ZBT's control.
And VulnCheck demonstrated exactly that. They registered a SPEAKINGSTONE backup domain and hundreds of devices reported in. For DARKLANTERN, it only required working out a static key.
Indicators of Compromise
Indicators taken from the VulnCheck report of 27 August 2026. Domains are defanged.
File hashes (SHA-256)
b77811db4d218c65670a6c9a5b33c30ff81c6d779e15d658643138771178a818 yunmgrd (SPEAKINGSTONE)
7e2e036fec2fe7ab4bbd43978d9296563894c92a112f5ac2f39957f12108e245 infosrvd (DARKLANTERN)
ae6c356f1f09260b859f84d994ef8423540a6c0bdf98510d86b85834283e4926 inetdetect (shared launcher)
C2 domains
www.ac-link[.]com # SPEAKINGSTONE primary C2 -> 47.107.224[.]89 (Alibaba Cloud, Shenzhen)
www.findmyipaddr[.]com # SPEAKINGSTONE backup C2 (currently sinkholed by VulnCheck)
Ports and protocols
UDP/9992 DARKLANTERN listener — internet-exposed by default firewall policy
UDP/8897 DARKLANTERN — destination port for info probe responses
UDP/10000 SPEAKINGSTONE — outbound beacon to C2
ZBT device fingerprints
# MAC OUI
78:A3:51 Allocated to Shenzhen Zhibotong Electronics
# Telnet banner
0;0HWelcome to MQWrt@
# Web interface (body)
wk-login-html
# SSH host key fingerprint (SHA-256)
e0ac6c083497d19e5ab3d28f9354e7d84b30793eba720c7f793aeb1ca9be9a41
# Accompanying SSH banner
SSH-2.0-dropbear_2014.63
# Hard-coded salt in DARKLANTERN
mqonu.com References MoreQuick, the firmware OEM
On-device paths
/usr/bin/yunmgrd SPEAKINGSTONE
/usr/bin/infosrvd DARKLANTERN
/etc/exec/cmd Command execution point for both implants
/etc/exec/sysinfo
/tmp/yunclient.conf SPEAKINGSTONE configuration
/tmp/info.txt Device fingerprint
/tmp/mac.txt Used by DARKLANTERN's MAC filter
/tmp/cmd.log
/usr/sbin/dns.sh DNS hijack activation script
Affected models — DARKLANTERN (CVE-2026-74233)
ZBT WE1326 18.1218, 19.0717, 19.1101
ZBT WE2426-C 19.0412, 19.0626, 19.0829, 19.1101, 19.1112
ZBT WE357 19.1101
ZBT WE5926 18.0904, 19.0617, 19.1101
ZBT WE5926-EC_QP 20.0516
ZBT WE5926-WD 19.1009, 19.1101
ZBT WE826-Q 19.1101
ZBT WE826-T2 19.0226, 19.0617, 19.0809, 19.1101
ZBT WE826-WD 19.0426, 19.0625, 19.0809, 19.1023, 19.1101
ZBT WF3526-P 19.051
ZBT WG108 19.0809, 19.1101
ZBT WG3526 19.0809, 19.1101
— CTN720-W1 19.0522, 19.1101
— LF-1541 19.1101
— MT7620N 19.0412, 19.0809, 19.1101
— WRC1 20.0622
Affected models — SPEAKINGSTONE (CVE-2026-74232)
ZBT WE826-T2 19.1101
ZBT L3_V2_8 3.0.0.4.528 <- 363/392 devices in the sinkhole
ZBT ZBT-7628 1.0.0.2.007
ZBT ZBT-ZBT7621 1.0.0.3.001
MoreQuick MQAC-7620 1.0.0.2.000
MoreQuick MQAC-7620A 1.0.0.2.000
MoreQuick MQAP-7620 1.0.0.2.000
MoreQuick MQAP-7620A 1.0.0.2.000
MoreQuick MQAP-7628 1.0.0.2.000
— AP522 1.0.0.2.014
— AP7628 3.0.0.4.380
— APG721B 19.0809
— HC5661A 3.0.0.4.380
— HK300 1.0.0.2.032
— MAP-N10 1.0.0.2.044
Detection Rules
VulnCheck published the rules below in the report appendix. They are ready to deploy without modification.
Suricata
alert udp any any -> any 9992 ( \
msg:"VULNCHECK Zbt/MoreQuick DARKLANTERN Wildcard-MAC Root Command Execution"; \
dsize:>27; content:"|0c 17 1f 12 34 56 00 00 00 00 00 00|"; offset:0; depth:12; \
pcre:"/^\x0c\x17\x1f\x12\x34\x56\x00{6}[0-9a-f]{4}.{2}[\x20-\x7e]{10}/s"; \
xbits:set,darklantern.cmd_injected,track ip_pair,expire 120; \
classtype:attempted-admin; sid:12800030; rev:1; \
metadata: deployment Datacenter, impact compromised;)
alert udp any any -> any 9992 ( \
msg:"VULNCHECK Zbt/MoreQuick DARKLANTERN Info Probe"; \
dsize:19; content:"|0c 16 1f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 78|"; offset:0; depth:19; \
classtype:attempted-recon; sid:12800031; rev:1; \
metadata: deployment Datacenter;)
alert udp any 9992 -> any 8897 ( \
msg:"VULNCHECK Zbt/MoreQuick DARKLANTERN Command Output Exfil"; \
content:"|0c 17 1f|"; offset:0; depth:3; \
xbits:isset,darklantern.cmd_injected,track ip_pair; \
classtype:successful-admin; sid:12800032; rev:2; \
metadata: deployment Datacenter, impact compromised;)
alert dns any any -> any any ( \
msg:"VULNCHECK Zbtlink Router SPEAKINGSTONE C2 Domain Lookup (www.ac-link.com)"; \
dns.query; content:"www.ac-link.com"; nocase; \
pcre:"/^www\.ac-link\.com$/i"; \
classtype:trojan-activity; sid:12800020; rev:1; \
metadata: deployment Datacenter, impact compromised;)
alert dns any any -> any any ( \
msg:"VULNCHECK Zbtlink Router SPEAKINGSTONE C2 Domain Lookup (www.findmyipaddr.com)"; \
dns.query; content:"www.findmyipaddr.com"; nocase; \
pcre:"/^www\.findmyipaddr\.com$/i"; \
classtype:trojan-activity; sid:12800021; rev:1; \
metadata: deployment Datacenter, impact compromised;)
alert udp $HOME_NET any -> any 10000 ( \
msg:"VULNCHECK Zbtlink Router SPEAKINGSTONE zbtProtocol reg Beacon"; \
dsize:>60; \
content:"|00 00 00 00|"; offset:9; depth:4; \
content:"|10 01|"; distance:4; within:2; \
byte_jump:2,0,big,from_beginning,post_offset 2; \
isdataat:!1,relative; \
classtype:trojan-activity; sid:12800022; rev:2; \
metadata: deployment Datacenter, impact compromised;)
alert udp any 10000 -> $HOME_NET any ( \
msg:"VULNCHECK Zbtlink Router SPEAKINGSTONE zbtProtocol Command Injection"; \
dsize:>21; \
content:"|78 22 3b|"; fast_pattern; \
content:"|00 00 00 00|"; offset:9; depth:4; \
content:"|25 07|"; distance:4; within:2; \
content:"|78 22 3b|"; distance:0; within:3; \
byte_jump:2,0,big,from_beginning,post_offset 2; \
isdataat:!1,relative; \
classtype:trojan-activity; sid:12800023; rev:2; \
metadata: deployment Datacenter, impact compromised;)
alert udp any 10000 -> $HOME_NET any ( \
msg:"VULNCHECK Zbtlink Router SPEAKINGSTONE zbtProtocol Credential/Hijack Op"; \
dsize:>18; \
content:"|00 00 00 00|"; offset:9; depth:4; \
pcre:"/^.{9}\x00{4}.{4}(\x25\x02|\x23\x0b)/s"; \
byte_jump:2,0,big,from_beginning,post_offset 2; \
isdataat:!1,relative; \
classtype:trojan-activity; sid:12800024; rev:2; \
metadata: deployment Datacenter, impact compromised;)
YARA
rule Zbtlink_Router_SPEAKINGSTONE_Implant
{
meta:
description = "MoreQuick/Zbtlink yunmgrd cloud-C2 implant (SPEAKINGSTONE)"
author = "vulncheck"
strings:
$proto = "zbtProtocol.c" ascii
$run = "zbt protocol running" ascii
$conf = "/tmp/yunclient.conf" ascii
$cmcc = "cmcc_server" ascii
$dns = "dnshack" ascii
$cmd = "/etc/exec/cmd" ascii
$back = "setBackServer" ascii
$reg = "regMsg" ascii
condition:
uint32(0) == 0x464C457F and 4 of them
}
rule Zbtlink_Router_DARKLANTERN_Implant
{
meta:
description = "MoreQuick/Zbtlink infosrvd backdoor (DARKLANTERN)"
author = "vulncheck"
strings:
$cmd = "/etc/exec/cmd " ascii
$sysinfo = "/etc/exec/sysinfo" ascii
$cmdlog = "/tmp/cmd.log" ascii
$infotxt = "/tmp/info.txt" ascii
$local = "startlocalserve" ascii
$salt = "Salt_171006_808290505" ascii
$allmac = "Allmac_171007_808290505" ascii
$validpkt = "invalid request pkt" ascii
$shell = "nosexecShellCmd" ascii
condition:
uint32(0) == 0x464C457F and 2 of ($salt, $allmac, $local, $validpkt)
and 3 of ($cmd, $sysinfo, $cmdlog, $infotxt, $shell)
}
VulnCheck also published a minimal DARKLANTERN scanner in Python in the report appendix — it sends the 19-byte info probe and parses the response for model, firmware and MAC. It is useful for quickly checking an internal IP range; see it directly in VulnCheck's post.
Assessment
This is not a patching problem. It is a supply chain trust problem.
A CVE can be patched. But three implants across multiple firmware generations from one manufacturer, accompanied by an official statement describing them as customer support tooling, is no longer a technical issue resolvable with an update.
The sharpest analytical detail is the hard-coded all-zeros MAC bypass. If there were only a checksum with a static salt, one could argue that is simply poor security design. But a dedicated code path for an all-zero MAC value, allowing anyone to send commands, is a decision rather than an oversight. VulnCheck requesting CWE-506 (Embedded Malicious Code) for SPEAKINGSTONE reflects the same judgement.
On implant design, SPEAKINGSTONE is the more instructive of the two. DARKLANTERN is an old-style backdoor: open a port, wait for a connection. It only works when the device is reachable from the internet — meaning NAT or a firewall neutralises it. SPEAKINGSTONE does not care. It connects outbound like any ordinary traffic and works behind any number of firewall layers.
For defenders the consequence is direct: inbound controls are not sufficient. The only thing that catches SPEAKINGSTONE is egress monitoring — specifically DNS lookups for the two domains in the IOC list, and outbound UDP traffic to port 10000 from network devices.
On reading the number 392 honestly. It is not the total SPEAKINGSTONE-infected population but only the devices never configured with a primary C2. That is a subset, and VulnCheck says the true total is almost certainly much larger. In internal reporting, present 392 as a demonstrable floor rather than an estimate.
Relevance for Vietnam
To state it plainly first: VulnCheck reports 203 DARKLANTERN instances across 22 countries but does not publish the full list; the countries they name include Israel, Ukraine, China, Hong Kong, Turkey and Taiwan. Vietnam is not named in the report.
The relevance to the domestic market is nonetheless direct, and does not depend on whether Vietnam is on that list.
The distribution model matches exactly. Vietnam's market carries a great many inexpensive Chinese-sourced 4G/LTE routers sold through Shopee, Lazada, TikTok Shop and small network equipment retailers. Most are sold under brands the buyer has never heard of, or with no clear brand at all. This is precisely the white-label model VulnCheck traced — and buyers have essentially no way of knowing who actually manufactured the device.
The use cases match too. VulnCheck notes the WE826's appeal lies in cellular connectivity: insert a SIM and it provides internet almost anywhere — oil pipelines, roadside billboards, trains, RVs — or serves as a failover when the primary connection drops. Domestically, these are exactly the deployments where 4G routers appear: coaches and tour vehicles, outdoor surveillance cameras, mobile point of sale, WAN backup for shops and branches, construction sites.
What all of these have in common: the device is installed once and never touched again. Nobody checks the firmware; nobody looks at what ports it has open.
One check that can be done immediately, with no tooling: read the MAC address from the device label or the admin interface. If it begins with 78:A3:51, that is ZBT hardware regardless of what brand appears on the case. It takes minutes and requires no technical capability.
Finally, if your organisation uses such a device as a WAN failover path, remember that SPEAKINGSTONE supports PPPoE credential theft and DNS hijacking. A device in that position is not merely an infected endpoint — it is the point through which all of the branch's traffic passes.
Recommendations
Inventory devices by MAC OUI
78:A3:51across the network estate, including devices carrying brands unrelated to ZBT — this is the fastest identification method and needs no tooling.Block inbound UDP/9992 at the perimeter and check whether any device in your organisation currently has this port exposed to the internet; that is never legitimate behaviour.
Monitor egress: alert on DNS lookups for
ac-link[.]comandfindmyipaddr[.]com, and on outbound UDP traffic to port 10000 from network devices — inbound controls do not catch SPEAKINGSTONE.Deploy VulnCheck's Suricata rules on perimeter IDS/IPS and in front of network device segments; they are ready to use and cover both implants.
Cross-check models and firmware versions against the two tables in the IOC section; where they match, treat the device as compromised and replace rather than update — ZBT removed the firmware from its website and patches were still in development at the time of writing.
Add hardware provenance requirements to procurement: for network equipment, require suppliers to disclose the actual OEM and firmware source rather than relying on the brand name on the box.
References
VulnCheck — Chinese Implants in the Supply Chain, Jacob Baines (27 August 2026) — original report, with the Suricata, YARA and Python scanner appendix
VulnCheck — ENDLESSDOORS Is Phoning Home. Pick up — research on the first implant
VulnCheck Advisory — Zbtlink MQWrt infosrvd Command Injection (CVE-2026-74233)
VulnCheck Advisory — Zbtlink MQWrt yunmgrd Cloud C2 Implant (CVE-2026-74232)
Shenzhen Zbtlink Electronics — Official Statement
The Hacker News — China-Made ZBT Routers Ship With Two Undocumented Implants
Reuters — China's Zbtlink suspends sales of routers found to contain backdoor
