Security Researchers Find Surveillance Implants in Chinese-Made Routers Sold Worldwide — Three Backdoor-Like Implants Hidden in Firmware

VulnCheck found three implants—ENDLESSDOORS, DARKLANTERN, and SPEAKINGSTONE—in ZBT router firmware sold under multiple brands worldwide.

The implants can communicate with remote infrastructure or accept unauthenticated Internet commands, enabling root command execution, DNS changes, and credential theft.

Researchers identified 203 Internet-exposed DARKLANTERN instances across 22 countries, highlighting the broad scope of the risk.