Implants in the Supply Chain

This threat involves three distinct implants—SPEAKINGSTONE, DARKLANTERN, and ENDLESSDOORS—embedded in ZBT router firmware distributed through a global supply chain. DARKLANTERN operates as an unauthenticated UDP backdoor listening on port 9992, allowing root shell access from the internet with trivial MAC address bypass. SPEAKINGSTONE functions as a phone-home surveillance implant that beacons to ZBT's cloud infrastructure and is capable of DNS hijacking, ISP credential theft, and remote command execution. The implants communicate using plaintext protocols without authentication, making them susceptible to hijacking by any network adversary. The affected hardware is incorporated into white-labeled consumer products sold through mainstream retailers, indicating embedded surveillance capabilities in commercial devices. A sinkholed backup domain revealed 392 infected devices, primarily in China, and internet scans identified 203 DARKLANTERN instances across 22 countries, including the United States, Canada, Australia, Philippines, Germany, and Russia.

The implants provide attackers with persistent backdoor access to affected routers, including root shell access via DARKLANTERN and remote command execution via SPEAKINGSTONE. This enables surveillance capabilities such as DNS hijacking and ISP credential theft. The use of plaintext protocols without authentication increases the risk of hijacking by other network adversaries. The widespread distribution of affected devices through mainstream retailers and presence in multiple countries amplifies the potential impact on privacy and network security.

No official patch or remediation is currently documented. Due to the implants being embedded in firmware distributed through the supply chain, remediation may require firmware replacement or device replacement. Network defenders should monitor for indicators of compromise such as the known IP addresses, domains, and hashes associated with these implants. Given the unauthenticated nature of the implants' communication, network segmentation and blocking of suspicious traffic (e.g., UDP port 9992) may reduce exposure. Check vendor advisories or firmware updates from ZBT or device vendors for any forthcoming fixes. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.