Loading story…
VulnCheck identified DARKLANTERN and SPEAKINGSTONE, two previously undocumented firmware implants in cellular routers made by Shenzhen Zhibotong Electronics (ZBT)/MoreQuick and sold internationally under ZBTlink and numerous OEM brands. Tracked as CVE-2026-74232 and CVE-2026-74233, DARKLANTERN exposes an unauthenticated UDP service on port 9992 that permits arbitrary commands as root. SPEAKINGSTONE beacons over UDP port 10000, including from devices behind NAT, and supports remote command execution, PPPoE/WAN credential theft, DNS hijacking, reverse SSH tunneling, and C2 reconfiguration; affected firmware also includes the previously reported ENDLESSDOORS implant in some models.
Internet scans found 203 DARKLANTERN-exposed devices in 22 countries across at least 16 device models. After registering an abandoned SPEAKINGSTONE backup C2 domain, researchers received beacons from 392 devices, 390 of them in China and largely appearing to be China Mobile customer-premises equipment; the implant’s primary C2 domain remained active. No separate criminal exploitation campaign has been confirmed, but organizations should regard affected routers as potentially compromised, restrict inbound UDP 9992 and outbound UDP 10000 traffic, investigate connected devices, and replace hardware where feasible. ZBTlink said it suspended sales of affected routers and took related software offline while developing updates, though no confirmed vendor fix was reported.
Pull IOCs and campaign context straight into your stack.
9 events from the most recent confirmed update back to the earliest known activity.
VulnCheck reported that SPEAKINGSTONE's primary C2 domain, www.ac-link[.]com, resolved to 47.107.224[.]89 when checked. It also published SHA-256 hashes and Suricata and YARA detection rules for associated components.
After registering the expired SPEAKINGSTONE backup C2 domain findmyipaddr[.]com, VulnCheck began receiving device beacons on August 21, 2026. The sinkhole recorded 392 unique devices, including 390 in China; 363 reported the L3_V2_8 model and firmware 3.0.0.4.528.
From August 18 through 21, 2026, VulnCheck identified 203 publicly reachable DARKLANTERN instances in 22 countries. The systems reported at least 16 device models; 103 were in the United States.
The analyzed ZBT-WE826-T2 firmware, which contained the SPEAKINGSTONE and DARKLANTERN implants but not ENDLESSDOORS, was built in 2019.
ZBTlink announced it would suspend sales of affected routers and take related software offline while developing updates. A vendor fix for affected devices had not been confirmed at the time of reporting.
VulnCheck assigned ENDLESSDOORS the identifier CVE-2026-66747 and rated it CVSS 9.3. The implant was reported to allow unauthenticated root-command execution through its insecure command-and-control mechanism.
VulnCheck identified ENDLESSDOORS in additional post-2019 ZBT firmware. The implant disguises its root-privileged process as kworker and uses a component called rctl, or Remote Control Linux, for separate C2 communications.
The SPEAKINGSTONE MQWrt yunmgrd implant was tracked as CVE-2026-74232 and DARKLANTERN infosrvd command injection as CVE-2026-74233. Both were rated CVSS v3 9.8, Critical.
VulnCheck identified the DARKLANTERN and SPEAKINGSTONE firmware implants in a Deep Orange-branded, white-labeled ZBT-WE826-T2 router. DARKLANTERN exposes unauthenticated root command execution via UDP/9992, while SPEAKINGSTONE provides outbound C2, command execution, credential theft, DNS hijacking, and reverse SSH functions.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 10 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
7 references tracked. Mallory keeps watching after this page renders.
xakep.ru
Open sourcecyberveille.ch
Open sourcetomshardware.com
Open sourcethehackernews.com
Open sourceheise.de
Open sourcesecurityonline.info
Open sourcevulncheck.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
VulnCheck reported that multiple **Zbtlink** and white-labeled routers ship with a built-in root-level implant, dubbed **ENDLESSDOORS**, embedded in firmware rather than added after deployment. The implant is a customized version of the open-source `rctl` remote-control tool, stored as `librctl.so` in OpenWrt, launched automatically at boot, and disguised as a userland process named `kworker`. Researchers said the malware initiates outbound cleartext TCP connections to hardcoded command-and-control infrastructure on ports `7000` and `7001`, with repeated callback attempts roughly every 35 seconds and no need for inbound internet exposure on the device. The issue has been assigned **`CVE-2026-66747`** and rated **Critical**, with reports stating that the command channel lacks authentication and encryption and that commands received are passed to `popen()` with `uid 0`. A reserved `rctlbash` function can also provide an interactive root shell, meaning any actor able to intercept the outbound path, hijack DNS or routing, or seize the fallback domain could gain unauthenticated remote code execution as root. Roughly 20 affected models have been identified, no fixed firmware is available, and defenders are being urged to inventory exposed devices, detect the implant, isolate impacted routers, or replace them.
Aug 15, 2026
Researchers reported a China-linked espionage campaign targeting enterprise edge routers in Southeast Asia with a custom Linux implant called `router.elf`. The malware uses encrypted HTTPS command-and-control over port 443 and Cloudflare DNS over HTTPS to conceal communications, while modifying `iptables` NAT rules to redirect downstream DNS traffic to attacker-controlled resolvers. Analysts said this gives the operators an infrastructure-level foothold for surveillance, traffic interception, and possible manipulation of internal network activity, including software update flows. The operation also appears to extend from compromised routers into Windows environments. Investigators linked the Linux activity to a secondary backdoor, `client_rc_start`, and to a Windows intrusion chain that deploys a Cobalt Strike Beacon through DLL sideloading, using a malicious `version.dll` loaded by `CrashReport.exe`. Shared command-and-control domains, URI patterns, cookie markers, user-agent values, and beacon timing indicate centralized control across the Linux and Windows components, while attribution clues cited in reporting include Mandarin-language strings, a `zh-CN` setting, and tooling overlaps with earlier China-linked operations.
Jun 29, 2026
A botnet campaign is scanning web-exposed router and network-device diagnostic interfaces for command-injection flaws in features such as **ping**, **traceroute**, and other troubleshooting tools. Internet Storm Center observed repeated automated requests against multiple diagnostic-related URL paths tied to known or suspected vulnerabilities, including `CVE-2024-12856` in Four-Faith routers, `CVE-2013-7179` in Seowon Intech WiMAX `SWU-9100` devices, `CVE-2020-8949` in Gocloud devices, and possibly `CVE-2024-48419` in Edimax routers. The activity indicates broad reconnaissance to identify devices where user input can be turned into shell commands, though the reporting does not confirm that every probed endpoint was vulnerable or successfully exploited. The coverage highlights why diagnostic utilities are a recurring weakness: they often pass user-supplied values into operating-system commands through unsafe string concatenation. Defenders are urged to disable remote administration where possible, limit management access to trusted networks, apply firmware updates, and replace unsupported hardware, while developers are advised to use argument-separated execution methods instead of building shell commands directly from web input.
Aug 5, 2026