Anoymask

Posted on Aug 28

SPEAKINGSTONE and DARKLANTERN in ZBT-Based White-Label Routers: WAN-Accessible Root Shell and DNS Hijacking

Anoymask · 2026-08-28T08:13:49Z

1. Overview Article Title : Chinese Routers Sold Worldwide Contain Backdoors Source : Dark Reading / VulnCheck Publication Date : 2026-08-27 Original Article : Dark Reading Related Source : VulnCheck primary research Related Malware, Threat Groups, CVEs, Products : SPEAKINGSTONE, DARKLANTERN, ENDLESSDOORS, ZBT WE826-T2, Deep Orange router, WiFlyer router, OpenWrt-derived firmware Severity : High (Unauthenticated remote control features found in white-label routers resold globally) 2. Summary SPEAKINGSTONE and DARKLANTERN in ZBT-based white-label routers enable unauthenticated root commands from the WAN, PPPoE credential theft, DNS hijacking, and reverse SSH. These vulnerabilities persist across multiple brands and countries. 3. Attack Flow DARKLANTERN WAN-Side Root Command infosrvd listens on UDP/9992, and the default firewall permits incoming traffic from the WAN. It responds to a 19-byte probe with the model, firmware, MAC, SSID, and IP address, allowing an attacker to identify the target. Command type 0x17 appends the payload to /etc/exec/cmd and executes arbitrary shell commands as root via semicolon injection. Although it uses a static MD5 suffix derived from a hardcoded domain, an all-zero MAC address can bypass validation. SPEAKINGSTONE C2 and DNS Hijacking yunmgrd initiates outbound connections to ac-link[.]com over UDP/10000. An unauthenticated protocol allows command execution, PPPoE credential retrieval, DNS modification, reverse SSH tunneling, and backup C2 updates. Received packets are in plain text, enabling an on-path attacker to spoof the legitimate C2 and hijack the router. VulnCheck sinkholed a forgotten backup domain and observed 392 devices, primarily located in China. 4. Attacker Position and Execution Location DARKLANTERN : An external attacker accessible from the Internet to UDP/9992. SPEAKINGSTONE : A vendor C2 operator, an entity that has seized the C2, or an on-path attacker along the communication route. 5. Visibility for Victims and Administrators Victims End users see standard home or branch office routers, making it difficult to identify the underlying hardware and firmware based solely on the brand name. ### Administrators WAN-side UDP/9992, ac-link[.]com:10000 , unexpected DNS changes, reverse SSH, and PPPoE credential access serve as key indicators. 6. Conditions for Success and Failure Success Conditions Vulnerable white-label firmware is in use, and the relevant daemon and WAN firewall settings are enabled. The router can reach the C2, or the attacker can reach the WAN UDP service. ### Failure Conditions & Risk Mitigation Inventory target models and firmware, and replace or isolate devices if vendor patches cannot be confirmed. Block WAN-side UDP/9992 and unnecessary outbound UDP/10000 traffic. Monitor DNS, PPPoE, SSH tunnels, and configuration changes, and treat routers as untrusted boundaries. 7. What Happens Upon Success Execution of arbitrary commands with root privileges. Traffic redirection via PPPoE credential theft and DNS hijacking. Persistent access to the internal network via a reverse SSH tunnel. Obfuscation of the impact scope due to identical OEM products being distributed under multiple brands. 8. Observable Logs Email : None. Proxy/SWG/DNS : Name resolution and communication to ac-link[.]com , findmyipaddr[.]com , and mqonu[.]com , along with changes to router DNS settings. Endpoint/EDR : Since routers typically lack EDR, collect firmware images, process lists, startup scripts, and configuration backups. Identity/IdP : Monitor for modifications or anomalous usage of PPPoE credentials. SaaS/Cloud : Check for unauthorized device registrations and the router vendor's cloud management accounts. Network : WAN UDP/9992 probes and commands, outbound UDP/10000 traffic, reverse SSH tunnels, and communication with unknown DNS servers. 9. Attack Success Determination Attack Attempt Observed (Success Unconfirmed) : Only UDP probes or C2 connections are observed, with no evidence of command execution. Initial Execution Confirmed : Unexpected root commands, DNS modifications, or reverse SSH tunnels are identified on the router. Information Theft or Session Compromise Confirmed : PPPoE credentials retrieved or traffic intercepted via DNS hijacking. Post-Compromise Activity Confirmed : Pivoting from the router into the local network or established persistent tunneling. 10. Investigation Playbook Trigger : Detection of ZBT/white-label vulnerable firmware, UDP/9992, ac-link C2, or router DNS changes. Initial Triage : Preserve exterior brand, model, board ID, firmware hash/version, configuration backups, WAN/LAN packets, and NAT/DNS logs. Endpoints : Check infosrvd / yunmgrd , /etc/exec/cmd , startup entries, authorized_keys , reverse tunnels, and unknown binaries. Authentication & Cloud : Rotate PPPoE, vendor cloud, and router admin credentials, and check for reuse. Post-Exploitation : Investigate credential theft following DNS hijacking, LAN scans, internal connections, and proxy behavior. Containment : Block WAN/egress traffic, replace the router or flash trusted firmware, rotate credentials, and monitor the local network. Classification : Categorize findings into vulnerable exposure, probes, root commands, credential theft, and LAN pivots. 11. Defense and Detection Ideas Single Event : Outbound traffic from a router to ac-link[.]com:10000 or an unknown reverse SSH destination. Temporal Correlation : Correlate WAN UDP probes, router command execution, DNS modifications, and changes in LAN/Internet traffic destinations. Threat Hunting : Search for matching MAC OUIs, board IDs, and firmware hashes across different brands, and verify UDP/9992 and UDP/10000 traffic flows. Log Limitations : Consumer and SOHO routers lack process and file auditing, making network logs insufficient to definitively confirm root command execution. Prioritized Mitigations : Asset inventory including OEM identities; WAN and egress filtering; replacement of devices running untrusted firmware. 12. Facts / Inference / Hypothesis Facts VulnCheck identified SPEAKINGSTONE and DARKLANTERN in firmware dating back to 2019. DARKLANTERN permits root command execution via WAN-accessible UDP/9992. A scan conducted between August 18 and 21, 2026, confirmed 203 DARKLANTERN instances across 22 countries. The SPEAKINGSTONE sinkhole observed 392 devices, 390 of which were located in China. The same hardware is sold globally under multiple brand names. ### Inference Brand-name-based vulnerability management often overlooks identical OEM firmware. Routers can be leveraged not only for initial access but also as persistent infrastructure for DNS manipulation, credential theft, and internal pivoting. ### Hypothesis Similar implants may still exist in other brands and models currently on the market. 13. MITRE ATT&CK Mapping T1059.004 Command and Scripting Interpreter: Unix Shell (High) : Passing UDP commands to a root shell. T1557 Adversary-in-the-Middle (High) : Traffic interception possible via DNS hijacking and unauthenticated C2. T1090 Proxy (Medium) : Using compromised routers as relays via reverse SSH tunnels. T1552 Unsecured Credentials (High) : PPPoE credential harvesting capability. 14. Unknowns and Areas for Further Investigation The identities and intent of the actors who embedded the implants, and the accountability relationships among vendors. The number of observed devices that actually received commands. A comprehensive mapping table of all currently marketed brands, models, and firmware versions. 15. Impact on SOCs and Organizations OEM routers may be deployed in branch offices and IoT environments under different brand names. Organizations should incorporate board IDs, firmware hashes, communication destinations, and WAN ports—not just exterior brand names—into asset management, and replace unpatchable devices. 16. Summary by Target Audience For SOC Analysts : Correlate UDP/9992, ac-link C2, DNS changes, and reverse SSH with router asset information. For Administrators : Verify OEM identities and firmware versions; isolate WAN access, restrict egress traffic, and replace affected devices. For End Users : Do not rely solely on brand names to determine the security of home or small office routers; check for update information from the providers.

#security #threatintel

1. Overview

Article Title: Chinese Routers Sold Worldwide Contain Backdoors
Source: Dark Reading / VulnCheck
Publication Date: 2026-08-27
Original Article: Dark Reading
Related Source: VulnCheck primary research
Related Malware, Threat Groups, CVEs, Products: SPEAKINGSTONE, DARKLANTERN, ENDLESSDOORS, ZBT WE826-T2, Deep Orange router, WiFlyer router, OpenWrt-derived firmware
Severity: High (Unauthenticated remote control features found in white-label routers resold globally)

2. Summary

SPEAKINGSTONE and DARKLANTERN in ZBT-based white-label routers enable unauthenticated root commands from the WAN, PPPoE credential theft, DNS hijacking, and reverse SSH. These vulnerabilities persist across multiple brands and countries.

3. Attack Flow

DARKLANTERN WAN-Side Root Command

infosrvd listens on UDP/9992, and the default firewall permits incoming traffic from the WAN.
It responds to a 19-byte probe with the model, firmware, MAC, SSID, and IP address, allowing an attacker to identify the target.
Command type 0x17 appends the payload to /etc/exec/cmd and executes arbitrary shell commands as root via semicolon injection.
Although it uses a static MD5 suffix derived from a hardcoded domain, an all-zero MAC address can bypass validation.

SPEAKINGSTONE C2 and DNS Hijacking

yunmgrd initiates outbound connections to ac-link[.]com over UDP/10000.
An unauthenticated protocol allows command execution, PPPoE credential retrieval, DNS modification, reverse SSH tunneling, and backup C2 updates.
Received packets are in plain text, enabling an on-path attacker to spoof the legitimate C2 and hijack the router.
VulnCheck sinkholed a forgotten backup domain and observed 392 devices, primarily located in China.

4. Attacker Position and Execution Location

DARKLANTERN: An external attacker accessible from the Internet to UDP/9992.
SPEAKINGSTONE: A vendor C2 operator, an entity that has seized the C2, or an on-path attacker along the communication route.

5. Visibility for Victims and Administrators

Victims

End users see standard home or branch office routers, making it difficult to identify the underlying hardware and firmware based solely on the brand name. ### Administrators
WAN-side UDP/9992, ac-link[.]com:10000, unexpected DNS changes, reverse SSH, and PPPoE credential access serve as key indicators.

6. Conditions for Success and Failure

Success Conditions

Vulnerable white-label firmware is in use, and the relevant daemon and WAN firewall settings are enabled.
The router can reach the C2, or the attacker can reach the WAN UDP service. ### Failure Conditions & Risk Mitigation
Inventory target models and firmware, and replace or isolate devices if vendor patches cannot be confirmed.
Block WAN-side UDP/9992 and unnecessary outbound UDP/10000 traffic.
Monitor DNS, PPPoE, SSH tunnels, and configuration changes, and treat routers as untrusted boundaries.

7. What Happens Upon Success

Execution of arbitrary commands with root privileges.
Traffic redirection via PPPoE credential theft and DNS hijacking.
Persistent access to the internal network via a reverse SSH tunnel.
Obfuscation of the impact scope due to identical OEM products being distributed under multiple brands.

8. Observable Logs

Email: None.
Proxy/SWG/DNS: Name resolution and communication to ac-link[.]com, findmyipaddr[.]com, and mqonu[.]com, along with changes to router DNS settings.
Endpoint/EDR: Since routers typically lack EDR, collect firmware images, process lists, startup scripts, and configuration backups.
Identity/IdP: Monitor for modifications or anomalous usage of PPPoE credentials.
SaaS/Cloud: Check for unauthorized device registrations and the router vendor's cloud management accounts.
Network: WAN UDP/9992 probes and commands, outbound UDP/10000 traffic, reverse SSH tunnels, and communication with unknown DNS servers.

9. Attack Success Determination

Attack Attempt Observed (Success Unconfirmed): Only UDP probes or C2 connections are observed, with no evidence of command execution.
Initial Execution Confirmed: Unexpected root commands, DNS modifications, or reverse SSH tunnels are identified on the router.
Information Theft or Session Compromise Confirmed: PPPoE credentials retrieved or traffic intercepted via DNS hijacking.
Post-Compromise Activity Confirmed: Pivoting from the router into the local network or established persistent tunneling.

10. Investigation Playbook

Trigger: Detection of ZBT/white-label vulnerable firmware, UDP/9992, ac-link C2, or router DNS changes.
Initial Triage: Preserve exterior brand, model, board ID, firmware hash/version, configuration backups, WAN/LAN packets, and NAT/DNS logs.
Endpoints: Check infosrvd/yunmgrd, /etc/exec/cmd, startup entries, authorized_keys, reverse tunnels, and unknown binaries.
Authentication & Cloud: Rotate PPPoE, vendor cloud, and router admin credentials, and check for reuse.
Post-Exploitation: Investigate credential theft following DNS hijacking, LAN scans, internal connections, and proxy behavior.
Containment: Block WAN/egress traffic, replace the router or flash trusted firmware, rotate credentials, and monitor the local network.
Classification: Categorize findings into vulnerable exposure, probes, root commands, credential theft, and LAN pivots.

11. Defense and Detection Ideas

Single Event: Outbound traffic from a router to ac-link[.]com:10000 or an unknown reverse SSH destination.
Temporal Correlation: Correlate WAN UDP probes, router command execution, DNS modifications, and changes in LAN/Internet traffic destinations.
Threat Hunting: Search for matching MAC OUIs, board IDs, and firmware hashes across different brands, and verify UDP/9992 and UDP/10000 traffic flows.
Log Limitations: Consumer and SOHO routers lack process and file auditing, making network logs insufficient to definitively confirm root command execution.
Prioritized Mitigations: Asset inventory including OEM identities; WAN and egress filtering; replacement of devices running untrusted firmware.

12. Facts / Inference / Hypothesis

Facts

VulnCheck identified SPEAKINGSTONE and DARKLANTERN in firmware dating back to 2019.
DARKLANTERN permits root command execution via WAN-accessible UDP/9992.
A scan conducted between August 18 and 21, 2026, confirmed 203 DARKLANTERN instances across 22 countries.
The SPEAKINGSTONE sinkhole observed 392 devices, 390 of which were located in China.
The same hardware is sold globally under multiple brand names. ### Inference
Brand-name-based vulnerability management often overlooks identical OEM firmware.
Routers can be leveraged not only for initial access but also as persistent infrastructure for DNS manipulation, credential theft, and internal pivoting. ### Hypothesis
Similar implants may still exist in other brands and models currently on the market.

13. MITRE ATT&CK Mapping

T1059.004 Command and Scripting Interpreter: Unix Shell (High): Passing UDP commands to a root shell.
T1557 Adversary-in-the-Middle (High): Traffic interception possible via DNS hijacking and unauthenticated C2.
T1090 Proxy (Medium): Using compromised routers as relays via reverse SSH tunnels.
T1552 Unsecured Credentials (High): PPPoE credential harvesting capability.

14. Unknowns and Areas for Further Investigation

The identities and intent of the actors who embedded the implants, and the accountability relationships among vendors.
The number of observed devices that actually received commands.
A comprehensive mapping table of all currently marketed brands, models, and firmware versions.

15. Impact on SOCs and Organizations

OEM routers may be deployed in branch offices and IoT environments under different brand names. Organizations should incorporate board IDs, firmware hashes, communication destinations, and WAN ports—not just exterior brand names—into asset management, and replace unpatchable devices.

16. Summary by Target Audience

For SOC Analysts: Correlate UDP/9992, ac-link C2, DNS changes, and reverse SSH with router asset information.
For Administrators: Verify OEM identities and firmware versions; isolate WAN access, restrict egress traffic, and replace affected devices.
For End Users: Do not rely solely on brand names to determine the security of home or small office routers; check for update information from the providers.

Top comments (1)

Luis Cruz • Aug 28

The detail about how DARKLANTERN utilizes a static MD5 suffix for validation while allowing all-zero MAC addresses to bypass it is particularly alarming, as it highlights a significant weakness in device security. Implementing stricter input validation and dynamic credentials could enhance security significantly. It's crucial to raise awareness among both end users and vendors about these vulnerabilities. If you're looking for assistance in developing more robust security measures for the firmware or enhancing the detection capabilities mentioned, I’d be glad to explore a paid collaboration. What strategies do you think could be effective in promoting better security practices among manufacturers?