Hidden Surveillance Implants Discovered in Global White-Label Routers

The hardware is white-labeled and shipped globally under dozens of brand names, complicating identification at the consumer level. For any deployment handling IoT traffic, this constitutes a pre-authentication, persistent root compromise — not a hypothetical vulnerability.

ENDLESSDOORS: persistent C2 with root shell

ENDLESSDOORS resides in the firmware image itself and launches at boot under the process name kworker, masquerading as a standard Linux kernel worker thread. It initiates outbound contact with a hardcoded command-and-control server on a recurring interval and accepts pushed commands, which are handed directly to a shell running as root. No meaningful authentication or transport encryption is applied to the channel. VulnCheck validated full device takeover by impersonating the C2 endpoint against their own test unit.

The implant is present across 20 confirmed ZBT models, including the Z8102AX, WG3526, and WE826-T3-DSIM series. The issue is tracked as CVE-2026-66747, assigned a CVSS 9.3. Any router running affected firmware and reachable by the implant's C2 — directly or via DNS hijack — is effectively pre-owned by the operator of that infrastructure.

DARKLANTERN and SPEAKINGSTONE: WAN-exposed and NAT-traversing

A second probe targeted an $88 "Deep Orange" cellular router purchased from a US Amazon seller. The unit was identified as a white-labeled ZBT-WE826-T2 running 2019-era firmware. Two additional implants were extracted.

DARKLANTERN operates as the infosrvd service and binds a listener on UDP port 9992 facing the WAN. A fixed 19-byte probe forces the device to return model, firmware version, MAC address, and uptime. Authentication is trivial to bypass: the command checksum relies on a static salt (mqonu.com), and the MAC allowlist is rendered ineffective by submitting an all-zeroes MAC field. Arbitrary command execution as root follows. Internet-wide scanning by VulnCheck located 203 exposed DARKLANTERN endpoints across 22 countries and 16 router models.

SPEAKINGSTONE runs as yunmgrd and functions differently — instead of waiting for inbound connections, it beacons outbound to ZBT-controlled infrastructure over UDP port 10000 using a custom format labeled zbtProtocol. Because it initiates the connection, it remains functional behind NAT and consumer firewalls, transmitting a full device fingerprint on each cycle.

Practical exposure and mitigation

The threat surface is not abstract. Affected hardware is distributed under OEM and ODM arrangements, meaning end users typically see only the reseller brand. A label change does not constitute a security boundary.

Checklist for current deployments:

• Identify the actual OEM of any deployed router. Cross-reference the model against the 20-model ENDLESSDOORS list and the 16-model DARKLANTERN exposure set.
• Audit WAN-facing services. Any open UDP 9992 listener indicates a DARKLANTERN-compromised unit; UDP 10000 outbound traffic from router processes suggests SPEAKINGSTONE.
• Confirm firmware provenance and update path. Vendor-published patches have not been confirmed in any source consulted.
• For new purchases: source routers from vendors with transparent firmware supply chains, reproducible builds, and independent security audits.

Verdict: skip any ZBT-platform hardware until vendor remediation is documented and verified. For existing deployments, assume compromise and replace.