ZBT Implants, Nanjing Botnets, and Bitkom’s China Attribution Are the Same Hardware Channel
Factory-level Chinese networking hardware supplies both state implants and criminal botnets, which is why intelligence services have overtaken traditional crime in German data-theft attributions.
The ZBT router implants (SPEAKINGSTONE/DARKLANTERN on UDP 10000/9992) and the 296K IoT botnet scanning water-system HMIs both trace to Chinese manufacturers; the DOJ sinkholing of Nanjing Xinjiuwei domains since 2018 shows the same firms have long operated the C2 infrastructure. Bitkom’s finding that German companies now blame foreign intelligence (led by China) for 39 % of data theft—overtaking ordinary crime—follows directly: the implants and botnet code share the same factory floor, so state and criminal use are indistinguishable at the device layer. No single article connects the three data points because each piece stayed inside its own silo (router firmware, survey stats, historic domain seizures).
Ordinary users will keep buying cheap routers that already contain the backdoors; the only visible change will be more frequent ‘mysterious’ outages and data leaks that never get traced to the original hardware.
Sources (1)
- [1]The Factum - full site digest(https://thefactum.ai)