# ZBT: Three Implants, One Supply Chain, and 392 Devices Calling a Forgotten Domain

## Summary

VulnCheck bought an **$88 router on Amazon from a small company in New York**. The label said Deep Orange. Underneath the shell was a ZBT-WE826-T2 from Shenzhen Zhibotong Electronics, and inside the firmware were two previously undocumented implants.

This is not a software vulnerability. This is **code that shipped by design**:

*   **DARKLANTERN** (service `infosrvd`) — a backdoor listening on UDP/9992 that executes arbitrary commands as root, **with no authentication**. The router's default firewall **explicitly allows inbound connections to this port from anywhere on the internet**.
    
*   **SPEAKINGSTONE** (service `yunmgrd`) — a phone-home implant beaconing out over UDP/10000, supporting DNS hijacking, PPPoE credential theft, and reverse SSH tunnels. Both are written in **Nim**, both communicate over UDP, and both are launched by the same connectivity watchdog binary, `inetdetect`.
    

VulnCheck found that SPEAKINGSTONE carries a backup C2 domain that **nobody had registered**. They registered it. The beacons arrived immediately: **392 devices, 390 of them in China, 83% on China Mobile's network**, with the longest-running device beaconing continuously for nearly two years.

**Priority action: check whether your organisation has any network device with a MAC address beginning** `78:A3:51` **— that is the OUI block allocated to ZBT, and the fastest way to recognise ZBT hardware under any brand label.**

* * *

## Background and Timeline

These are the **second and third implants** discovered from the same manufacturer, across multiple firmware generations.

| Date | Event |
| --- | --- |
| 5 Aug 2026 | VulnCheck publishes **ENDLESSDOORS** — the first phone-home implant found in ZBT firmware |
| 6 Aug 2026 | ZBT announces it has suspended sales of the affected models and removed the relevant firmware from its official website |
| 18–21 Aug 2026 | VulnCheck scans the internet with DARKLANTERN info probes, identifying **203 instances across 22 countries** |
| 21 Aug 2026 | The SPEAKINGSTONE sinkhole records **392 devices** reporting in |
| **27 Aug 2026** | VulnCheck publishes **DARKLANTERN** and **SPEAKINGSTONE**, with two CVEs |

Two CVEs were assigned, both **CVSS 9.3 (Critical)** and both already in **VulnCheck KEV**:

| CVE | Implant | Classification |
| --- | --- | --- |
| [CVE-2026-74233](https://console.vulncheck.com/cve/CVE-2026-74233) | DARKLANTERN (`infosrvd`) | CWE-321 Hard-coded Cryptographic Key + CWE-78 OS Command Injection |
| [CVE-2026-74232](https://console.vulncheck.com/cve/CVE-2026-74232) | SPEAKINGSTONE (`yunmgrd`) | CWE-506 Embedded Malicious Code + CWE-300 Channel Accessible by Non-Endpoint |

Worth noting on classification: CWE-506 means **"Embedded Malicious Code"**. That is not how a CVE-assigning organisation describes a programming mistake.

![](https://cdn.hashnode.com/uploads/covers/676511773cdd3c06f7b226ee/7a1150af-d3ce-4041-971b-331aa9d95cfb.png align="center")

*The relationship between SPEAKINGSTONE, DARKLANTERN and their shared launcher* `inetdetect` *(source: VulnCheck).*

* * *

## DARKLANTERN: A Backdoor Exposed to the Internet by Default

DARKLANTERN runs as a service called `infosrvd`, listening on UDP port 9992.

The part to read closely is the router's own default firewall:

```plaintext
/tmp # iptables -L udp_packets
Chain udp_packets (1 references)
target     prot opt source               destination
ACCEPT     udp  --  anywhere             anywhere             udp dpt:9992
```

This rule permits inbound connections to port 9992 **from anywhere on the internet**. VulnCheck states it plainly: by design, it is reachable from the outside world.

This is not a user misconfiguration. This is the factory configuration.

The protocol, which the binary internally calls `revProto`, is simple, unauthenticated and unencrypted. There are two packet types.

### Info Probe: 19 Bytes to Expose the Whole Device

An info probe is 19 bytes. Send it to UDP/9992 and the device responds back to UDP/8897 with its model, firmware version, MAC address, uptime and other identifying information.

```plaintext
0c 16 1f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01
```

No authentication. No challenge. No session.

This is a real response VulnCheck captured **from a device in Ukraine** — model, MAC, SSID and public IP all in the clear:

```plaintext
\0c\16\1fWE826-T2;19.0617;78a35165f294;733752;;0;0;0;0;0;3835201070;2639069874;;;
295428312;5111713550;47586414082;2534543950;192.168.1.1;;_XPAM_;2;;10;;;;;;;
2018-11-12;ffff;27199800;45.156.37.159;27028260;0;0;0;0;0
```

### Command Packet: One UDP Packet Is a Root Shell

A command packet (type `0x17`) carries a shell string in its payload. The service passes it **directly** to `system("/etc/exec/cmd " + payload)`.

A semicolon in the payload breaks out of the fixed prefix and executes arbitrary commands. **No length limit. No character filtering.**

![](https://cdn.hashnode.com/uploads/covers/676511773cdd3c06f7b226ee/107b0d32-1e5e-4bc5-8dc3-cb78c30f5e03.png align="center")

*The DARKLANTERN command packet format (source: VulnCheck).*

Two fields gate whether a packet is accepted — and both are trivially defeated.

**The token.** Command packets require a four-byte keyed checksum, computed as the last four hex characters of `md5("mqonu.com" + payload)`. The key `"mqonu.com"` is **hard-coded in the backdoor and therefore unchangeable**. Anyone can compute a valid checksum for any payload:

```python
import hashlib
token = hashlib.md5(b"mqonu.com" + payload).hexdigest()[-4:].encode()
```

The string `mqonu.com` is never contacted as a URL — it is only a static salt. But it references **MoreQuick, the Chinese OEM that developed the firmware for the ZBT-WE826-T2**, and therefore ties implant development directly to MoreQuick.

**The MAC filter — and its built-in bypass.** Command packets carry a six-byte MAC address field, checked against the device's own MAC in `/tmp/mac.txt`. A mismatch drops the packet. In theory that is at least a reasonable attempt at blocking arbitrary attackers — ignoring the fact that the info probe already returns the device's MAC.

Except for one thing: **the code contains a hard-coded bypass. If the MAC field is all zeros, the check passes and the packet is queued for processing.**

This is the detail I consider most significant in the DARKLANTERN analysis. A logic error in a MAC check could be an oversight. A dedicated branch handling an all-zero value, written into the code, is not.

### Scale on the Internet

![](https://cdn.hashnode.com/uploads/covers/676511773cdd3c06f7b226ee/3ef81208-65e0-4d79-b602-8c6abdb6a731.png align="center")

*Distribution of internet-facing DARKLANTERN instances (source: VulnCheck).*

Between **18 and 21 August 2026**, VulnCheck identified **203 internet-facing DARKLANTERN instances across 22 countries**.

Every one of those devices offers an unauthenticated root shell, reachable from the public internet, protected by a checksum anyone can forge and a MAC filter with an intentional bypass.

![](https://cdn.hashnode.com/uploads/covers/676511773cdd3c06f7b226ee/20b93fee-4f84-4543-ac8b-7331cb1769bf.png align="center")

*Sixteen self-reported models in the scan data (source: VulnCheck).*

The scan also shows DARKLANTERN is **not limited to the ZBT-WE826-T2**: responding devices self-reported **16 different models**. This is not one product with a problem — it is a firmware-level backdoor shipped with multiple products.

VulnCheck adds that these are older models, and the firmware on their test device was built in 2019 — they are likely catching the tail end of DARKLANTERN's deployment, and **the installed base was almost certainly larger**.

* * *

## SPEAKINGSTONE: The Considerably More Capable Implant

SPEAKINGSTONE differs from DARKLANTERN in a fundamental way: **it does not listen for connections, it makes them.**

VulnCheck explains why this is a much better design for a remote operator. A listener like DARKLANTERN depends on the router being directly reachable from the internet — put the device behind a firewall, behind NAT, behind a corporate gateway, and the listener is useless. A phone-home implant does not care: it connects outbound, like any other internet traffic. Behind five firewalls, behind carrier-grade NAT, on a private network — it still works.

The **primary C2** on the test device is `ac-link[.]com`, resolving to `47.107.224[.]89`, an **Alibaba Cloud address in Shenzhen**. This is ZBT's own domain, and the same domain documented in the ENDLESSDOORS research, with the same IP hard-coded into an ENDLESSDOORS init script.

### The zbtProtocol

The implant beacons to C2 on UDP port 10000. The beacon carries a **full device fingerprint**: model, firmware version, MAC, SSID, LAN IP, uptime, **GPS coordinates**, and the entire contents of `/tmp/info.txt`.

![](https://cdn.hashnode.com/uploads/covers/676511773cdd3c06f7b226ee/f8962383-1005-4d5a-91a5-a92a330434ea.png align="center")

*The SPEAKINGSTONE beacon wire format (source: VulnCheck).*

On protection: on the WE826-T2, outbound messages are obfuscated with a **single-byte XOR (**`0x1f`**)** — but **not all devices do this**, suggesting the obfuscation is optional or was added later. Inbound commands from the C2 are **always plaintext**.

No encryption. No authentication. The device **has no way to verify it is talking to a legitimate server**. Anyone on the network path can hijack these implants.

### Command Set

| msgType | Name | Effect |
| --- | --- | --- |
| `0x1001` | reg | Device fingerprint beacon |
| `0x2507` | cmdRun | **Execute arbitrary commands** |
| `0x2502` | pppoe | **Exfiltrate the WAN PPPoE username and password** |
| `0x230b` | dnsSet | **Write a DNS hijack list, activated via** `/usr/sbin/dns.sh` |
| `0x2306` | dnsGet | Return the current DNS hijack list |
| `0x2405` | onoff | **Open or close a reverse SSH tunnel** |
| `0x2406` | sshport | Return the current reverse SSH port |
| `0x2602` | setBackup | Update backup C2 server addresses |

In response to ENDLESSDOORS, ZBT stated that implant was an "after-sales technical support tool." VulnCheck's comment on SPEAKINGSTONE is direct: customer support tools do not steal ISP credentials, and they do not hijack DNS.

* * *

## The Sinkhole: 392 Devices and One Model

SPEAKINGSTONE carries a hard-coded backup C2 domain: `www.findmyipaddr[.]com`. This is **not a failover** — if `ac-link[.]com` is configured but unreachable, the implant does not fall back, it simply waits. Any device that reaches for the backup domain **was never configured with a primary C2 in the first place**.

The domain is obfuscated in the `yunmgrd` binary by string splitting: `"ww"+"w.f"+"indmy"+"ipadd"+"r.co"+"m"` — a basic attempt to hide it from string searches.

![](https://cdn.hashnode.com/uploads/covers/676511773cdd3c06f7b226ee/bf6261fc-4ab4-4c78-8010-117504c4f41d.png align="center")

*The split domain string in the binary (source: VulnCheck).*

At the time of analysis, `findmyipaddr[.]com` **was not registered**. VulnCheck registered it and stood up a server running a reverse-engineered implementation of zbtProtocol.

![](https://cdn.hashnode.com/uploads/covers/676511773cdd3c06f7b226ee/44e864af-ba36-426e-822d-f57332579abd.png align="center")

*The SPEAKINGSTONE sinkhole workflow (source: VulnCheck).*

The beacons started arriving immediately. As of **21 August 2026**:

| Metric | Value |
| --- | --- |
| Devices reporting in | **392** (collection ongoing) |
| Located in China | **390 / 392** |
| On China Mobile's network | **83%** |
| Broadcasting SSIDs beginning "CMCC" | **304** |
| Model L3\_V2\_8, firmware 3.0.0.4.528 | **363 / 392** |
| Longest continuous beaconing | **nearly two years** |

![](https://cdn.hashnode.com/uploads/covers/676511773cdd3c06f7b226ee/5bcf3fbf-e2b6-4260-b191-db81957d03a1.png align="center")

*Carrier distribution of the devices reporting to the sinkhole (source: VulnCheck).*

VulnCheck assesses that L3\_V2\_8 is **not a router you buy off a shelf** but a carrier CPE deployed on China Mobile's network. Same model, same firmware, same carrier, same country.

Their conclusion: this is domestic Chinese surveillance technology, deployed inside China, on Chinese networks, at scale — **and the same implants are running on routers sold to Americans through Amazon**.

**An important caveat on that number:** 392 covers only devices reaching the backup domain, meaning devices never configured with a primary C2. `ac-link[.]com` is still live. The full population of SPEAKINGSTONE-equipped devices **is unknown and almost certainly much larger**.

* * *

## The Supply Chain: Where the Hardware Goes, the Firmware Follows

Everything above was found on **a single $88 router**, sold by a small company in New York. Deep Orange did not build it — they white-labelled it.

![](https://cdn.hashnode.com/uploads/covers/676511773cdd3c06f7b226ee/f8af4319-89c3-4626-8ba0-e2443b2bdbee.png align="center")

*The bottom label reads WE826, matching a ZBT FCC filing (source: VulnCheck).*

Three independent pieces of evidence tie the device to ZBT: the bottom sticker labels it a **WE826**, matching a Shenzhen Zhibotong Electronics FCC filing; the routers look identical; and the MAC address begins with `78:A3:51`, a block allocated to ZBT.

Shenzhen Zhibotong Electronics is not known as a consumer brand. Mostly it manufactures devices that other companies sell under different names. VulnCheck traced the chain through FCC filings, patent records and archived web pages, finding ZBT hardware under brands in the **United States, Canada, Australia, the Philippines, Germany and Russia**.

Some representative examples:

| Brand | Market | Evidence of ZBT connection |
| --- | --- | --- |
| **Deep Orange** | US (Amazon) | WE826-T FCC filing; MAC OUI `78:A3:51` |
| **WiFlyer** | US (Amazon, Newegg) | **ZBT owns the trademark per USPTO records** — these are not ZBT-derived, they *are* ZBT |
| **WORDFI** | Philippines (Shopee) | Trademark registered with USPTO by ZBT |
| **Cioswi** | Russia (AliExpress), US (Amazon) | Archived support page directs users to `sales03@zbt-china.com` |
| **MOFI4500-4GXeLTE** | Canada | FCC filing includes a schematic titled "ZBT-WE826"; matching MAC OUI |
| **Digineo AC1200 Pro / ALLNET** | Germany | Built on the WG3526 and WG2626 platforms (OpenWrt identifies the latter) |
| **Lippert WiFi On-The-Go / Wave WiFi MBR** | US | WE826 platform, aimed at RVs and boats |
| **OneX RV WIFI Route** | Australia | Rebranded WE826 |

![](https://cdn.hashnode.com/uploads/covers/676511773cdd3c06f7b226ee/f636a5b2-d901-4878-a041-0522035e8029.png align="center")

*The same ZBT hardware appearing under three different brand names (source: VulnCheck).*

**One important point to preserve for fairness:** VulnCheck states clearly that **not all of these contain the implants**. MOFI develops custom firmware, and the MOFI firmware they examined **contained no implants**.

ZBT hardware does not automatically mean an implant. **The firmware is what decides.** The problem is that buyers usually have no way of knowing where the firmware on their device came from.

The conclusion VulnCheck draws, and it is the right one: just because you have never heard of Shenzhen Zhibotong Electronics or the ZBT-WE826 does not mean you have never interacted with one.

* * *

## ZBT's Response, and VulnCheck's Rebuttal

Following the ENDLESSDOORS disclosure, ZBT published an **official statement** on its website. The substance:

*   The remote management component mentioned in the report serves **solely as an after-sales technical support tool**, intended to assist customers with device troubleshooting and configuration **only upon their explicit request and authorization**.
    
*   This component **has never been used for unauthorized access**.
    
*   Measures taken: **sales of affected models immediately suspended**, **downloads of the relevant firmware removed from the official website**, with firmware updates in development. VulnCheck's rebuttal has three parts, and I find it well-founded:
    

**No mechanism for request or authorization was found.** VulnCheck states they found no mechanism by which a customer could explicitly request or authorize access. ENDLESSDOORS was designed like an implant, and some variants relied on dynamic DNS providers — infrastructure more commonly associated with malware than with legitimate customer support.

**The "never used for unauthorized access" claim is logically meaningless.** None of the three implants support secure communications. Anyone on the network path can hijack ENDLESSDOORS or SPEAKINGSTONE. **ZBT cannot know** whether these implants have been used for unauthorized access, because access to them is not under ZBT's control.

**And VulnCheck demonstrated exactly that.** They registered a SPEAKINGSTONE backup domain and hundreds of devices reported in. For DARKLANTERN, it only required working out a static key.

* * *

## Indicators of Compromise

> Indicators taken from the VulnCheck report of 27 August 2026. Domains are defanged.

**File hashes (SHA-256)**

```plaintext
b77811db4d218c65670a6c9a5b33c30ff81c6d779e15d658643138771178a818    yunmgrd     (SPEAKINGSTONE)
7e2e036fec2fe7ab4bbd43978d9296563894c92a112f5ac2f39957f12108e245    infosrvd    (DARKLANTERN)
ae6c356f1f09260b859f84d994ef8423540a6c0bdf98510d86b85834283e4926    inetdetect  (shared launcher)
```

**C2 domains**

```plaintext
www.ac-link[.]com          # SPEAKINGSTONE primary C2 -> 47.107.224[.]89 (Alibaba Cloud, Shenzhen)
www.findmyipaddr[.]com     # SPEAKINGSTONE backup C2 (currently sinkholed by VulnCheck)
```

**Ports and protocols**

```plaintext
UDP/9992     DARKLANTERN listener — internet-exposed by default firewall policy
UDP/8897     DARKLANTERN — destination port for info probe responses
UDP/10000    SPEAKINGSTONE — outbound beacon to C2
```

**ZBT device fingerprints**

```plaintext
# MAC OUI
78:A3:51                                    Allocated to Shenzhen Zhibotong Electronics
 
# Telnet banner
0;0HWelcome to MQWrt@
 
# Web interface (body)
wk-login-html
 
# SSH host key fingerprint (SHA-256)
e0ac6c083497d19e5ab3d28f9354e7d84b30793eba720c7f793aeb1ca9be9a41
 
# Accompanying SSH banner
SSH-2.0-dropbear_2014.63
 
# Hard-coded salt in DARKLANTERN
mqonu.com                                   References MoreQuick, the firmware OEM
```

**On-device paths**

```plaintext
/usr/bin/yunmgrd          SPEAKINGSTONE
/usr/bin/infosrvd         DARKLANTERN
/etc/exec/cmd             Command execution point for both implants
/etc/exec/sysinfo
/tmp/yunclient.conf       SPEAKINGSTONE configuration
/tmp/info.txt             Device fingerprint
/tmp/mac.txt              Used by DARKLANTERN's MAC filter
/tmp/cmd.log
/usr/sbin/dns.sh          DNS hijack activation script
```

**Affected models — DARKLANTERN (CVE-2026-74233)**

```plaintext
ZBT     WE1326           18.1218, 19.0717, 19.1101
ZBT     WE2426-C         19.0412, 19.0626, 19.0829, 19.1101, 19.1112
ZBT     WE357            19.1101
ZBT     WE5926           18.0904, 19.0617, 19.1101
ZBT     WE5926-EC_QP     20.0516
ZBT     WE5926-WD        19.1009, 19.1101
ZBT     WE826-Q          19.1101
ZBT     WE826-T2         19.0226, 19.0617, 19.0809, 19.1101
ZBT     WE826-WD         19.0426, 19.0625, 19.0809, 19.1023, 19.1101
ZBT     WF3526-P         19.051
ZBT     WG108            19.0809, 19.1101
ZBT     WG3526           19.0809, 19.1101
—       CTN720-W1        19.0522, 19.1101
—       LF-1541          19.1101
—       MT7620N          19.0412, 19.0809, 19.1101
—       WRC1             20.0622
```

**Affected models — SPEAKINGSTONE (CVE-2026-74232)**

```plaintext
ZBT         WE826-T2       19.1101
ZBT         L3_V2_8        3.0.0.4.528      <- 363/392 devices in the sinkhole
ZBT         ZBT-7628       1.0.0.2.007
ZBT         ZBT-ZBT7621    1.0.0.3.001
MoreQuick   MQAC-7620      1.0.0.2.000
MoreQuick   MQAC-7620A     1.0.0.2.000
MoreQuick   MQAP-7620      1.0.0.2.000
MoreQuick   MQAP-7620A     1.0.0.2.000
MoreQuick   MQAP-7628      1.0.0.2.000
—           AP522          1.0.0.2.014
—           AP7628         3.0.0.4.380
—           APG721B        19.0809
—           HC5661A        3.0.0.4.380
—           HK300          1.0.0.2.032
—           MAP-N10        1.0.0.2.044
```

* * *

## Detection Rules

> VulnCheck published the rules below in the report appendix. They are ready to deploy without modification.

### Suricata

```plaintext
alert udp any any -> any 9992 ( \
    msg:"VULNCHECK Zbt/MoreQuick DARKLANTERN Wildcard-MAC Root Command Execution"; \
    dsize:>27; content:"|0c 17 1f 12 34 56 00 00 00 00 00 00|"; offset:0; depth:12; \
    pcre:"/^\x0c\x17\x1f\x12\x34\x56\x00{6}[0-9a-f]{4}.{2}[\x20-\x7e]{10}/s"; \
    xbits:set,darklantern.cmd_injected,track ip_pair,expire 120; \
    classtype:attempted-admin; sid:12800030; rev:1; \
    metadata: deployment Datacenter, impact compromised;)
 
alert udp any any -> any 9992 ( \
    msg:"VULNCHECK Zbt/MoreQuick DARKLANTERN Info Probe"; \
    dsize:19; content:"|0c 16 1f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 78|"; offset:0; depth:19; \
    classtype:attempted-recon; sid:12800031; rev:1; \
    metadata: deployment Datacenter;)
 
alert udp any 9992 -> any 8897 ( \
    msg:"VULNCHECK Zbt/MoreQuick DARKLANTERN Command Output Exfil"; \
    content:"|0c 17 1f|"; offset:0; depth:3; \
    xbits:isset,darklantern.cmd_injected,track ip_pair; \
    classtype:successful-admin; sid:12800032; rev:2; \
    metadata: deployment Datacenter, impact compromised;)
 
alert dns any any -> any any ( \
    msg:"VULNCHECK Zbtlink Router SPEAKINGSTONE C2 Domain Lookup (www.ac-link.com)"; \
    dns.query; content:"www.ac-link.com"; nocase; \
    pcre:"/^www\.ac-link\.com$/i"; \
    classtype:trojan-activity; sid:12800020; rev:1; \
    metadata: deployment Datacenter, impact compromised;)
 
alert dns any any -> any any ( \
    msg:"VULNCHECK Zbtlink Router SPEAKINGSTONE C2 Domain Lookup (www.findmyipaddr.com)"; \
    dns.query; content:"www.findmyipaddr.com"; nocase; \
    pcre:"/^www\.findmyipaddr\.com$/i"; \
    classtype:trojan-activity; sid:12800021; rev:1; \
    metadata: deployment Datacenter, impact compromised;)
 
alert udp $HOME_NET any -> any 10000 ( \
    msg:"VULNCHECK Zbtlink Router SPEAKINGSTONE zbtProtocol reg Beacon"; \
    dsize:>60; \
    content:"|00 00 00 00|"; offset:9; depth:4; \
    content:"|10 01|"; distance:4; within:2; \
    byte_jump:2,0,big,from_beginning,post_offset 2; \
    isdataat:!1,relative; \
    classtype:trojan-activity; sid:12800022; rev:2; \
    metadata: deployment Datacenter, impact compromised;)
 
alert udp any 10000 -> $HOME_NET any ( \
    msg:"VULNCHECK Zbtlink Router SPEAKINGSTONE zbtProtocol Command Injection"; \
    dsize:>21; \
    content:"|78 22 3b|"; fast_pattern; \
    content:"|00 00 00 00|"; offset:9; depth:4; \
    content:"|25 07|"; distance:4; within:2; \
    content:"|78 22 3b|"; distance:0; within:3; \
    byte_jump:2,0,big,from_beginning,post_offset 2; \
    isdataat:!1,relative; \
    classtype:trojan-activity; sid:12800023; rev:2; \
    metadata: deployment Datacenter, impact compromised;)
 
alert udp any 10000 -> $HOME_NET any ( \
    msg:"VULNCHECK Zbtlink Router SPEAKINGSTONE zbtProtocol Credential/Hijack Op"; \
    dsize:>18; \
    content:"|00 00 00 00|"; offset:9; depth:4; \
    pcre:"/^.{9}\x00{4}.{4}(\x25\x02|\x23\x0b)/s"; \
    byte_jump:2,0,big,from_beginning,post_offset 2; \
    isdataat:!1,relative; \
    classtype:trojan-activity; sid:12800024; rev:2; \
    metadata: deployment Datacenter, impact compromised;)
```

### YARA

```plaintext
rule Zbtlink_Router_SPEAKINGSTONE_Implant
{
  meta:
    description = "MoreQuick/Zbtlink yunmgrd cloud-C2 implant (SPEAKINGSTONE)"
    author = "vulncheck"
 
  strings:
    $proto = "zbtProtocol.c" ascii
    $run   = "zbt protocol running" ascii
    $conf  = "/tmp/yunclient.conf" ascii
    $cmcc  = "cmcc_server" ascii
    $dns   = "dnshack" ascii
    $cmd   = "/etc/exec/cmd" ascii
    $back  = "setBackServer" ascii
    $reg   = "regMsg" ascii
 
  condition:
    uint32(0) == 0x464C457F and 4 of them
}
 
rule Zbtlink_Router_DARKLANTERN_Implant
{
  meta:
    description = "MoreQuick/Zbtlink infosrvd backdoor (DARKLANTERN)"
    author = "vulncheck"
 
  strings:
    $cmd      = "/etc/exec/cmd " ascii
    $sysinfo  = "/etc/exec/sysinfo" ascii
    $cmdlog   = "/tmp/cmd.log" ascii
    $infotxt  = "/tmp/info.txt" ascii
    $local    = "startlocalserve" ascii
    $salt     = "Salt_171006_808290505" ascii
    $allmac   = "Allmac_171007_808290505" ascii
    $validpkt = "invalid request pkt" ascii
    $shell    = "nosexecShellCmd" ascii
 
  condition:
    uint32(0) == 0x464C457F and 2 of ($salt, $allmac, $local, $validpkt)
      and 3 of ($cmd, $sysinfo, $cmdlog, $infotxt, $shell)
}
```

VulnCheck also published a **minimal DARKLANTERN scanner in Python** in the report appendix — it sends the 19-byte info probe and parses the response for model, firmware and MAC. It is useful for quickly checking an internal IP range; see it directly in [VulnCheck's post](https://www.vulncheck.com/blog/zbt-darklantern-speakingstone).

* * *

## Assessment

**This is not a patching problem. It is a supply chain trust problem.**

A CVE can be patched. But three implants across multiple firmware generations from one manufacturer, accompanied by an official statement describing them as customer support tooling, is no longer a technical issue resolvable with an update.

**The sharpest analytical detail is the hard-coded all-zeros MAC bypass.** If there were only a checksum with a static salt, one could argue that is simply poor security design. But a dedicated code path for an all-zero MAC value, allowing anyone to send commands, is a decision rather than an oversight. VulnCheck requesting CWE-506 (Embedded Malicious Code) for SPEAKINGSTONE reflects the same judgement.

**On implant design, SPEAKINGSTONE is the more instructive of the two.** DARKLANTERN is an old-style backdoor: open a port, wait for a connection. It only works when the device is reachable from the internet — meaning NAT or a firewall neutralises it. SPEAKINGSTONE does not care. It connects outbound like any ordinary traffic and works behind any number of firewall layers.

For defenders the consequence is direct: **inbound controls are not sufficient.** The only thing that catches SPEAKINGSTONE is egress monitoring — specifically DNS lookups for the two domains in the IOC list, and outbound UDP traffic to port 10000 from network devices.

**On reading the number 392 honestly.** It is not the total SPEAKINGSTONE-infected population but only the devices **never configured with a primary C2**. That is a subset, and VulnCheck says the true total is almost certainly much larger. In internal reporting, present 392 as a demonstrable floor rather than an estimate.

### Relevance for Vietnam

**To state it plainly first:** VulnCheck reports 203 DARKLANTERN instances across 22 countries but does not publish the full list; the countries they name include Israel, Ukraine, China, Hong Kong, Turkey and Taiwan. **Vietnam is not named in the report.**

The relevance to the domestic market is nonetheless direct, and does not depend on whether Vietnam is on that list.

**The distribution model matches exactly.** Vietnam's market carries a great many inexpensive Chinese-sourced 4G/LTE routers sold through Shopee, Lazada, TikTok Shop and small network equipment retailers. Most are sold under brands the buyer has never heard of, or with no clear brand at all. This is precisely the white-label model VulnCheck traced — and buyers have essentially no way of knowing who actually manufactured the device.

**The use cases match too.** VulnCheck notes the WE826's appeal lies in cellular connectivity: insert a SIM and it provides internet almost anywhere — oil pipelines, roadside billboards, trains, RVs — or serves as a failover when the primary connection drops. Domestically, these are exactly the deployments where 4G routers appear: coaches and tour vehicles, outdoor surveillance cameras, mobile point of sale, WAN backup for shops and branches, construction sites.

What all of these have in common: **the device is installed once and never touched again**. Nobody checks the firmware; nobody looks at what ports it has open.

**One check that can be done immediately, with no tooling:** read the MAC address from the device label or the admin interface. If it begins with `78:A3:51`, that is ZBT hardware regardless of what brand appears on the case. It takes minutes and requires no technical capability.

Finally, if your organisation uses such a device as a WAN failover path, remember that SPEAKINGSTONE supports **PPPoE credential theft and DNS hijacking**. A device in that position is not merely an infected endpoint — it is the point through which all of the branch's traffic passes.

* * *

## Recommendations

*   **Inventory devices by MAC OUI** `78:A3:51` across the network estate, including devices carrying brands unrelated to ZBT — this is the fastest identification method and needs no tooling.
    
*   **Block inbound UDP/9992 at the perimeter** and check whether any device in your organisation currently has this port exposed to the internet; that is never legitimate behaviour.
    
*   **Monitor egress:** alert on DNS lookups for `ac-link[.]com` and `findmyipaddr[.]com`, and on outbound UDP traffic to port 10000 from network devices — inbound controls do not catch SPEAKINGSTONE.
    
*   **Deploy VulnCheck's Suricata rules** on perimeter IDS/IPS and in front of network device segments; they are ready to use and cover both implants.
    
*   **Cross-check models and firmware versions against the two tables in the IOC section**; where they match, treat the device as compromised and **replace rather than update** — ZBT removed the firmware from its website and patches were still in development at the time of writing.
    
*   **Add hardware provenance requirements to procurement:** for network equipment, require suppliers to disclose the actual OEM and firmware source rather than relying on the brand name on the box.
    

* * *

## References

*   VulnCheck — [Chinese Implants in the Supply Chain](https://www.vulncheck.com/blog/zbt-darklantern-speakingstone), Jacob Baines (27 August 2026) — original report, with the Suricata, YARA and Python scanner appendix
    
*   VulnCheck — [ENDLESSDOORS Is Phoning Home. Pick up](https://www.vulncheck.com/blog/zbt-endlessdoors) — research on the first implant
    
*   VulnCheck Advisory — [Zbtlink MQWrt infosrvd Command Injection (CVE-2026-74233)](https://www.vulncheck.com/advisories/zbtlink-mqwrt-infosrvd-command-injection)
    
*   VulnCheck Advisory — [Zbtlink MQWrt yunmgrd Cloud C2 Implant (CVE-2026-74232)](https://www.vulncheck.com/advisories/zbtlink-mqwrt-yunmgrd-cloud-c2-implant)
    
*   Shenzhen Zbtlink Electronics — [Official Statement](https://www.zbtlink.com/pages/zbt-router-firmware-download-announcement)
    
*   The Hacker News — [China-Made ZBT Routers Ship With Two Undocumented Implants](https://thehackernews.com/2026/08/china-made-zbt-routers-ship-with-two.html)
    
*   Reuters — [China's Zbtlink suspends sales of routers found to contain backdoor](https://www.reuters.com/world/asia-pacific/chinas-zbtlink-suspends-sales-routers-found-contain-backdoor-2026-08-06/)