Classification: TLP:WHITE | Severity: CRITICAL | Intelligence Category: Infostealer & Credential Theft Campaigns
Threat Summary
AlienVault OTX pulse data, corroborated by VulnCheck research, confirms the discovery of three distinct firmware implants — SPEAKINGSTONE, DARKLANTERN, and ENDLESSDOORS — embedded in ZBT router firmware distributed through a global supply chain. Affected devices have reached organizations and consumers in the United States, Canada, Australia, Philippines, Germany, Russia, China, Hong Kong, Israel, Taiwan, and Ukraine, with the technology and telecommunications sectors named as primary targets.
The most immediately dangerous component is DARKLANTERN: an unauthenticated UDP backdoor listening on port 9992 that grants root shell access directly from the internet. The implant's only access control — a MAC address check — is trivially bypassable, meaning any internet-facing compromised ZBT router is effectively an open root shell to the world.
The collective campaign profile — three separate implant families, firmware-level persistence, global distribution, and phone-home infrastructure (www.ac-link.com, www.findmyipaddr.com) — points to a deliberate, well-resourced supply chain operation consistent with surveillance infrastructure buildout rather than opportunistic cybercrime. Compromised routers sit at the ideal interception point for credential harvesting, session token theft, and traffic manipulation — all traffic traversing the device, including VPN-adjacent and SSO flows, is exposed to the implant operator. While the threat actor remains unattributed, the tradecraft (multi-implant redundancy, firmware persistence, geographic spread including Five Eyes and Indo-Pacific targets) aligns with state-aligned espionage and credential-theft objectives.
Threat Actor / Malware Profile
DARKLANTERN — UDP Root Backdoor
- Distribution: Embedded in ZBT router firmware at the supply chain level (factory or distributor-stage compromise).
- Payload behavior: Listens on UDP port 9992, providing unauthenticated root shell access from the internet.
- Authentication bypass: Relies on a MAC address check that is trivially spoofable — an attacker need only know or guess the expected MAC format.
- Impact: Full device takeover; attacker gains a privileged network pivot point, traffic interception position, and a launchpad for lateral movement.
SPEAKINGSTONE & ENDLESSDOORS — Companion Implants
- Role: Redundant persistence and phone-home capability. Multi-implant architecture is a hallmark of sophisticated supply chain operations — if one implant is discovered and removed, the others survive.
- C2 communication: Phone-home beacons to attacker-controlled or attacker-monitored domains, including
www.ac-link.comandwww.findmyipaddr.com(the latter masquerading as a legitimate IP-lookup service — a classic disguise for exfiltration and victim telemetry check-ins). - Persistence mechanism: Firmware-level implantation — survives factory resets, config wipes, and standard AV/EDR coverage, since host-based tooling never inspects router firmware.
- Anti-analysis: Firmware embedding evades virtually all endpoint detection; legitimate-looking phone-home hostnames blend with benign network telemetry; UDP-based C2 avoids TCP session logging on many perimeter devices.
Credential Theft Angle: Routers compromised at this level can harvest cleartext credentials from intercepted traffic, inject malicious content into HTTP sessions, redirect DNS to credential-phishing infrastructure, and capture VPN/portal authentication attempts — making this an infostealer-grade threat even without a traditional host-resident stealer payload.
IOC Analysis
The pulse contains 7 indicators across two types:
| Type | Indicators | Operationalization |
|---|---|---|
| FileHash-SHA256 / SHA1 (5 total) | 7e2e036f..., ae6c356f..., b77811db..., 4309d107..., 681b57b6... | Firmware image and implant binary hashes. Load into EDR blocklists, and critically, into any firmware validation/scanning workflow. Hash-match downloaded ZBT firmware images before deployment. |
| Hostname (2 total) | www.ac-link.com, www.findmyipaddr.com | Phone-home/C2 infrastructure. Block at DNS resolver, proxy, and firewall egress. Retro-hunt DNS logs for historical resolution — any hit indicates a compromised device on the network. |
SOC operational guidance:
- DNS retro-hunt first. Router compromise leaves few host artifacts, but DNS resolution of the phone-home domains from internal network segments (especially from subnets containing routers, IoT, or edge devices) is a high-fidelity compromise indicator.
- Egress monitoring on UDP 9992 — no legitimate business service should be listening on or dialing out via UDP 9992 from network infrastructure devices.
- Tooling: Ingest indicators into your SIEM via STIX/TAXII from OTX; use
get_iocs/otxintegrations in MISP, Cortex, or OpenCTI for automated enrichment. Verify hash matches withsha256sum/Get-FileHashagainst firmware images in your environment.
Detection Engineering
YAML
---
title: DARKLANTERN Implant UDP 9992 Backdoor Activity
id: 9f1a2b3c-4d5e-6f70-8192-aabbccddeef0
status: experimental
description: Detects network connections on UDP port 9992 associated with the DARKLANTERN unauthenticated root backdoor found in ZBT router firmware implants.
author: Security Arsenal Threat Intelligence
references:
- https://www.vulncheck.com/blog/zbt-darklantern-speakingstone
date: 2026/09/27
logsource:
category: network_connection
product: windows
detection:
selection:
DestinationPort: 9992
Protocol: udp
selection_listen:
SourcePort: 9992
Protocol: udp
condition: selection or selection_listen
falsepositives:
- Rare; no common legitimate services use UDP 9992
level: critical
tags:
- attack.command_and_control
- attack.t1071
- attack.t1571
---
title: ZBT Implant Phone-Home Domain Resolution - SPEAKINGSTONE ENDLESSDOORS
id: 1a2b3c4d-5e6f-7081-92aa-bbccddee0011
status: experimental
description: Detects DNS queries to known phone-home domains used by SPEAKINGSTONE and ENDLESSDOORS firmware implants in ZBT routers.
author: Security Arsenal Threat Intelligence
references:
- https://www.vulncheck.com/blog/zbt-darklantern-speakingstone
date: 2026/09/27
logsource:
category: dns
detection:
selection:
query|contains:
- 'ac-link.com'
- 'findmyipaddr.com'
condition: selection
falsepositives:
- findmyipaddr.com may be visited legitimately; investigate source device type (network infrastructure devices querying it is highly suspicious)
level: high
tags:
- attack.command_and_control
- attack.t1071.001
---
title: ZBT Firmware Implant File Hash Execution
id: 2b3c4d5e-6f70-8192-aabb-ccddee002233
status: experimental
description: Detects execution or creation of files matching known SHA256/SHA1 hashes of SPEAKINGSTONE, DARKLANTERN, and ENDLESSDOORS implant binaries.
author: Security Arsenal Threat Intelligence
references:
- https://www.vulncheck.com/blog/zbt-darklantern-speakingstone
date: 2026/09/27
logsource:
category: process_creation
product: windows
detection:
selection_hashes:
Hashes|contains:
- '7e2e036fec2fe7ab4bbd43978d9296563894c92a112f5ac2f39957f12108e245'
- 'ae6c356f1f09260b859f84d994ef8423540a6c0bdf98510d86b85834283e4926'
- 'b77811db4d218c65670a6c9a5b33c30ff81c6d779e15d658643138771178a818'
- '4309d107af6a23f4a7f841b9148258e1a280b972'
- '681b57b6bf79ff0fdcfd19633586a6dcd3491651'
condition: selection_hashes
falsepositives:
- None expected; hash matches are high fidelity
level: critical
tags:
- attack.execution
- attack.persistence
- attack.t1542.001
KQL — Microsoft Sentinel / Defender
// ZBT Firmware Implant Hunt: DARKLANTERN UDP 9992 + Phone-Home Domains + Hashes
let ImplantHashes = dynamic([
"7e2e036fec2fe7ab4bbd43978d9296563894c92a112f5ac2f39957f12108e245",
"ae6c356f1f09260b859f84d994ef8423540a6c0bdf98510d86b85834283e4926",
"b77811db4d218c65670a6c9a5b33c30ff81c6d779e15d658643138771178a818",
"4309d107af6a23f4a7f841b9148258e1a280b972",
"681b57b6bf79ff0fdcfd19633586a6dcd3491651"]);
let PhoneHomeDomains = dynamic(["ac-link.com", "findmyipaddr.com"]);
let NetworkHits = DeviceNetworkEvents
| where Timestamp > ago(30d)
| where (RemotePort == 9992 or LocalPort == 9992)
or (RemoteUrl has_any (PhoneHomeDomains))
| project Timestamp, DeviceName, RemoteIP, RemotePort, RemoteUrl, InitiatingProcessFileName, Protocol="Network";
let DnsHits = DeviceNetworkEvents
| where Timestamp > ago(30d)
| where RemoteUrl has_any (PhoneHomeDomains)
| project Timestamp, DeviceName, RemoteIP, RemoteUrl, Protocol="DNS-PhoneHome";
let HashHits = DeviceProcessEvents
| where Timestamp > ago(30d)
| where SHA256 in~ (ImplantHashes) or SHA1 in~ (ImplantHashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, SHA1, Protocol="HashMatch";
union NetworkHits, DnsHits, HashHits
| order by Timestamp desc
PowerShell
# Security Arsenal - ZBT Firmware Implant IOC Hunt (DARKLANTERN / SPEAKINGSTONE / ENDLESSDOORS)
# Run elevated on endpoints and management jump hosts; pair with router config/firmware audit.
$implantHashes = @(
"7e2e036fec2fe7ab4bbd43978d9296563894c92a112f5ac2f39957f12108e245",
"ae6c356f1f09260b859f84d994ef8423540a6c0bdf98510d86b85834283e4926",
"b77811db4d218c65670a6c9a5b33c30ff81c6d779e15d658643138771178a818",
"4309d107af6a23f4a7f841b9148258e1a280b972",
"681b57b6bf79ff0fdcfd19633586a6dcd3491651"
)
$phoneHomeDomains = @("ac-link.com", "findmyipaddr.com")
$findings = @()
Write-Host "[1/4] Checking for listeners/connections on UDP 9992 (DARKLANTERN backdoor)..." -ForegroundColor Cyan
$udp9992 = Get-NetUDPEndpoint -LocalPort 9992 -ErrorAction SilentlyContinue
if ($udp9992) {
$findings += "CRITICAL: UDP 9992 listener present (DARKLANTERN backdoor indicator)"
$udp9992 | Format-Table LocalAddress, LocalPort, OwningProcess -AutoSize
}
Write-Host "[2/4] Checking DNS cache for phone-home domains..." -ForegroundColor Cyan
$dnsCache = Get-DnsClientCache -ErrorAction SilentlyContinue | Where-Object {
$entry = $_.Entry; $phoneHomeDomains | Where-Object { $entry -like "*$_*" }
}
if ($dnsCache) {
$findings += "HIGH: Phone-home domain(s) found in DNS cache"
$dnsCache | Format-Table Entry, Data, Status -AutoSize
}
Write-Host "[3/4] Scanning for implant file hashes in common staging locations..." -ForegroundColor Cyan
$scanPaths = @("$env:TEMP", "$env:ProgramData", "C:\Users\Public", "$env:USERPROFILE\Downloads")
foreach ($path in $scanPaths) {
Get-ChildItem -Path $path -Recurse -File -ErrorAction SilentlyContinue | ForEach-Object {
$h = (Get-FileHash -Path $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
$h1 = (Get-FileHash -Path $_.FullName -Algorithm SHA1 -ErrorAction SilentlyContinue).Hash
if ($implantHashes -contains $h -or $implantHashes -contains $h1) {
$findings += "CRITICAL: Implant hash match: $($_.FullName)"
}
}
}
Write-Host "[4/4] Checking for any ZBT firmware images staged locally for hash verification..." -ForegroundColor Cyan
$firmware = Get-ChildItem -Path "C:\" -Recurse -Include *.bin,*.img,*.trx -ErrorAction SilentlyContinue
foreach ($fw in $firmware) {
$fwHash = (Get-FileHash -Path $fw.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash
if ($implantHashes -contains $fwHash) {
$findings += "CRITICAL: Compromised firmware image: $($fw.FullName)"
}
}
if ($findings.Count -gt 0) {
Write-Host "`n=== FINDINGS ===" -ForegroundColor Red
$findings | ForEach-Object { Write-Host $_ -ForegroundColor Red }
} else {
Write-Host "`nNo implant indicators found on this host." -ForegroundColor Green
}
Response Priorities
Immediate (0–4 hours):
- Block
www.ac-link.comandwww.findmyipaddr.comat DNS resolver, secure web gateway, and firewall egress; alert on any resolution attempt. - Block and alert on UDP port 9992 at the perimeter and internal segmentation boundaries — both inbound and outbound.
- Inventory every ZBT-manufactured router in the environment, including remote office, branch, and home-user edge devices; take suspect devices offline pending firmware validation.
- Ingest the 5 file hashes into EDR blocklists and firmware-scanning pipelines.
24 Hours:
- Retro-hunt 90 days of DNS/proxy/firewall logs for the phone-home domains and UDP 9992 activity; any hit = presumed compromise.
- Because compromised routers can silently intercept credentials in transit: force credential rotation for any user or service account whose traffic traversed a confirmed compromised device — prioritize VPN, SSO, and administrative portal credentials. Invalidate active sessions and tokens.
- Review authentication logs for anomalous logins that could indicate credentials harvested via router-level interception; enforce MFA re-enrollment where session tokens may have been captured.
1 Week:
- Replace or reflash compromised ZBT devices with vendor-verified firmware, validated by hash before installation.
- Implement egress filtering for network infrastructure segments — routers and IoT devices should only reach explicitly allow-listed update/management endpoints.
- Establish a supply chain firmware validation process: hash-verify all firmware images against vendor-published values before deployment, and add network device integrity monitoring to the SOC's coverage.
- Review procurement for ZBT and white-label/OEM-rebadged hardware; assess alternative vendors for edge infrastructure.
Related Resources
Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.