Derp.ca
Data by Hatching Triage opens in a new tab Network Device

SPEAKINGSTONE

SPEAKINGSTONE is a firmware-resident remote-access implant in certain Shenzhen Zhibotong Electronics (ZBT/Zbtlink) router products, tracked as CVE-2026-74232.

Profile source: Mallory opens in a new tab

SPEAKINGSTONE

Family profile

SPEAKINGSTONE is a firmware-resident remote-access implant in certain Shenzhen Zhibotong Electronics (ZBT/Zbtlink) router products, tracked as CVE-2026-74232. It initiates periodic outbound UDP command-and-control communications, allowing it to operate from routers behind NAT. The implant transmits device fingerprinting information and accepts plaintext remote commands that permit arbitrary command execution with root privileges. Supported functions include collection of WAN PPPoE usernames and passwords, modification and retrieval of DNS-hijacking rules that can redirect LAN clients, reverse SSH tunnel management, and command-and-control reconfiguration. It was identified in 2019-era firmware on a white-label ZBT-WE826-T2 device and has also been associated with ZBT L3_V2_8 and other ZBT- and MoreQuick-derived products. ZBT hardware is distributed internationally through OEM and white-label channels, although implant presence is not universal across ZBT-derived firmware. Sinkholing of an unregistered backup command-and-control endpoint observed hundreds of beaconing devices, predominantly China Mobile-associated devices in China; these observations establish deployed implant-bearing devices but do not independently establish third-party compromise or a distinct criminal exploitation campaign.

Capabilities

  • Credential Theft
  • Exfiltration
  • Post Exploitation

Exploited software

Vulnerabilities linked to SPEAKINGSTONE

1 CVEs
CVE-2026-74232 SPEAKINGSTONE unauthenticated root RCE in Zbtlink and MoreQuick firmware

MITRE ATT&CK

SPEAKINGSTONE in ATT&CK

23 distinct techniques

Techniques

23 techniques
T1557 Adversary-in-the-Middle T1210 Exploitation of Remote Services T1095 Non-Application Layer Protocol T1552 Unsecured Credentials T1059 Command and Scripting Interpreter T1572 Protocol Tunneling T1565.002 Transmitted Data Manipulation T1542.001 System Firmware T1571 Non-Standard Port T1020 Automated Exfiltration T1090.001 Internal Proxy T1059.004 Unix Shell T1041 Exfiltration Over C2 Channel T1195.003 Compromise Hardware Supply Chain T1090.002 External Proxy T1082 System Information Discovery T1008 Fallback Channels T1016 System Network Configuration Discovery T1190 Exploit Public-Facing Application T1090 Proxy T1195 Supply Chain Compromise T1027 Obfuscated Files or Information T1552.001 Credentials In Files

Reporting

Research mentioning SPEAKINGSTONE

Aug 28
Heise

(OEM-)China-Router von ZBT mit Backdoors | heise online

VulnCheck identified DARKLANTERN and SPEAKINGSTONE, two previously undocumented firmware implants in cellular routers made by Shenzhen Zhibotong Electronics (ZBT)/MoreQuick and sold internationally under ZBTlink and numerous OEM brands. Tracked as CVE-2026-74232 and CVE-2026-74233, DARKLANTERN exposes an unauthenticated UDP service on port 9992 that permits arbitrary commands as root. SPEAKINGSTONE beacons over UDP port 10000, including from devices behind NAT, and supports remote command execution, PPPoE/WAN credential theft, DNS hijacking, reverse SSH tunneling, and C2 reconfiguration; affected firmware also includes the previously reported ENDLESSDOORS implant in some models. Internet scans found 203 DARKLANTERN-exposed devices in 22 countries across at least 16 device models. After registering an abandoned SPEAKINGSTONE backup C2 domain, researchers received beacons from 392 devices, 390 of them in China and largely appearing to be China Mobile customer-premises equipment; the implant’s primary C2 domain remained active. No separate criminal exploitation campaign has been confirmed, but organizations should regard affected routers as potentially compromised, restrict inbound UDP 9992 and outbound UDP 10000 traffic, investigate connected devices, and replace hardware where feasible. ZBTlink said it suspended sales of affected routers and took related software offline while developing updates, though no confirmed vendor fix was reported.
Aug 28
Security Online Info

ZBT Router Backdoor Sinkholed by VulnCheck
Aug 27
Vulncheck

Chinese Implants in the Supply Chain | Blog | VulnCheck

We appreciate you

Derp wouldn't exist without the work these projects do for the security community. We rely on their data sources to improve the quality and depth of what we publish. Thank you, we're genuinely grateful.

Hatching Triage opens in new tab IPinfo opens in new tab urlscan.io opens in new tab Mallory opens in new tab eCrime.ch opens in new tab ransomware.live opens in new tab