Executive Summary
Analysis of Shenzhen Zhibotong (ZBT) electronics routers reveals the presence of three distinct implants—SPEAKINGSTONE, DARKLANTERN, and ENDLESSDOORS—embedded within the supply chain. These implants have been identified in global consumer and enterprise hardware, often white-labeled under various Western brands. While ZBT claims these are 'technical support tools,' the discovery of DNS hijacking capabilities, ISP credential theft, and hardcoded backdoors suggests deliberate surveillance intent.
Technically, the implants leverage unencrypted and unauthenticated UDP-based protocols. DARKLANTERN acts as a WAN listener on port 9992, allowing for a root shell breakout with a trivial checksum bypass. SPEAKINGSTONE is a phone-home implant that beacons to Alibaba-hosted infrastructure in China or a hardcoded backup domain, enabling remote commands and reverse SSH tunnels even behind NAT.
The discovery matters due to the sheer scale of the ZBT supply chain. These routers are sold via major retailers like Amazon and Newegg under multiple brand names, meaning thousands of devices globally are currently accessible via root backdoors to any actor capable of replicating these findings or hijacking the C2 infrastructure.