Loading malware…
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
SPEAKINGSTONE beacons outward as yunmgrd over UDP port 10000. The C2 replies with commands, allowing arbitrary command execution, PPPoE credential theft, DNS hijacking, and reverse SSH tunnels.
11 distinct techniques documented for this family, organized by ATT&CK tactic.
“SPEAKINGSTONE is the more capable ZBT router backdoor. It can run arbitrary commands, steal PPPoE ISP credentials, hijack DNS, and open reverse SSH tunnels.”
7 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Firmware-level cloud C2 surveillance implant in ZBT routers. It initiates outbound communications, allowing operation behind NAT/firewalls, and provides root-level remote command execution, credential theft, DNS manipulation, and reverse SSH tunneling.
A Nim-based router implant launched as yunmgrd. It uses the UDP-based zbtProtocol on port 10000 to beacon detailed device fingerprints to C2 infrastructure. It supports arbitrary root-command execution, PPPoE credential exfiltration, DNS-hijack list configuration, reverse SSH tunnel control, and backup-C2 updates. C2 communications lack authentication and encryption, allowing network-path hijacking.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.