ZBT Routers Contain Factory Implants SPEAKINGSTONE and DARKLANTERN Granting Root via UDP 10000 and 9992

SPEAKINGSTONE runs as yunmgrd and beacons over UDP 10000 to a hardcoded C2, supporting root command execution, PPPoE credential exfil, DNS hijacking, and reverse SSH. DARKLANTERN listens on UDP 9992 with ineffective authentication using a hardcoded salt and zeroed MAC wildcard, exposed to the internet. Both were present on an $88 WE826-T2 purchased in the US. VulnCheck scanned 203 DARKLANTERN instances across 22 countries between August 18-21, tied to at least 16 models. The implants predate the August 5 disclosure of ENDLESSDOORS in 20 Zbtlink variants. Firmware builds from 2019-2020 list exact versions without upgrade paths or vendor fixes.

ZBT hardware is rebranded by multiple resellers, making model numbers the only reliable identifier. IEEE MAC prefixes 78:A3:51 and F8:5E:3C trace directly to Shenzhen Zhibotong Electronics. The SPEAKINGSTONE backup C2 domain remained unregistered until VulnCheck claimed it and observed incoming beacons. No independent firmware analysis from other researchers has confirmed or refuted the scope beyond the listed builds.

These implants represent persistent supply-chain access points rather than post-compromise additions. The pattern matches prior router vendor findings where outbound C2 and open management ports survive NAT and basic filtering. Absence of fixed firmware leaves owners without remediation guidance outside model-specific checks.