China-Made ZBT Routers Ship With Two Implants Giving Unauthenticated Attackers Root Access

Two undocumented firmware implants — SPEAKINGSTONE and DARKLANTERN — were discovered pre-installed on ZBT routers manufactured by Shenzhen Zhibotong Electronics, meaning the threat arrived baked into the hardware before customers ever powered the devices on. These implants allow unauthenticated remote attackers to gain root-level access and execute arbitrary commands, representing a critical supply chain compromise at the manufacturer level. This matters because organizations often implicitly trust hardware straight out of the box, skipping firmware validation and network isolation steps that could have detected or contained the threat. The discovery highlights that supply chain integrity — not just software patching — must be a core pillar of any organization's security posture.