Backdoors Found in ZBT Routers Sold Globally

www.vulncheck.com

Backdoors Found in ZBT Routers Sold Globally

First seen 27 Aug 2026, 20:19 UTC • •64.3

Article Content

1 / 6

Browse articles

ThreatCluster •August 28, 2026 at 19:54 UTC

•ZBT routers contain multiple backdoors, including 'SpeakingStone' and 'DarkLantern'.
•The backdoors allow remote command execution and bypass firewall protections.
•ZBT's routers are sold globally, affecting millions of users.

ZBT routers, widely sold under various brands, have been found to contain multiple backdoors, including 'SpeakingStone' and 'DarkLantern'. These implants allow unauthorized remote access and command execution. The vulnerabilities were discovered by Jacob Baines, CTO of VulnCheck, who identified that ZBT routers beacon to a compromised domain upon activation. The backdoors are designed to bypass firewalls, making them particularly dangerous. The routers are sold in numerous countries, including the US, Canada, and Australia, with ZBT's annual output estimated at 3.6 million units. The issue affects a broad range of models and poses a significant risk to users' networks. The discovery has prompted urgent calls for users to secure their devices. As of now, the extent of exploitation remains unclear.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 44d ago How this analysis works

Timeline

2026-08-06

Backdoor discovery announced

Jacob Baines revealed ZBT's router firmware contains a root-level backdoor named 'EndlessDoors'.

2026-08-27

Further implants identified

Baines discovered two additional backdoors, 'SpeakingStone' and 'DarkLantern', in a different ZBT router model.

2026-08-27

Global impact assessment

ZBT routers are reported to be sold in over 50 countries, affecting millions of devices worldwide.

More articles in this cluster (5)

Threat Graph

8 entities, 8 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (2)

Malware
T1071 - Application Layer Protocol

Organization (2)

DeepOrange
Zbtlink

Malware (3)

DarkLantern
Endlessdoors
SpeakingStone

Affected Platform (1)

Linux

Relationships

DarkLantern targets DeepOrange
DarkLantern targets Zbtlink
Endlessdoors targets DeepOrange
Endlessdoors targets Zbtlink
SpeakingStone targets DeepOrange
SpeakingStone targets Zbtlink
Malware targets Linux
T1071 - Application Layer Protocol targets Linux

Following this threat?

Track DarkLantern and DeepOrange in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

CVE-2015-3306 Exploited in ProFTPD FTP Servers CVE-2015-3306, a vulnerability in ProFTPD 1.3.5, allows remote attackers to read and write arbitrary files using the SITE CPFR and SITE CPTO commands. This exploit can lead to unauthorized access and potential remote code execution, as the commands are executed with the privileges of the ProFTPD service. Active…

CISA Mandates Urgent Patching of Five Critical Flaws Exploited by Flax Typhoon The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal agencies to patch five critical vulnerabilities by October 11, 2026, following exploitation by the China-linked hacking group Flax Typhoon. The vulnerabilities, added to CISA's Known Exploited Vulnerabilities (KEV) catalog, include…