Pre-Installed Backdoors Found in Globally Distributed ZBT Routers
ZBT routers sold worldwide under multiple white-label brands were found to contain manufacturer-installed backdoors, granting unauthorized remote access to any network the devices are connected to. This is a classic supply chain compromise, where the threat is embedded before the product ever reaches the end user, making traditional perimeter defenses ineffective. The use of white-label rebranding amplifies the risk by obscuring the true origin of the hardware and making vulnerability tracking extremely difficult. Organizations that unknowingly deploy these devices may expose their entire internal network to external threat actors with no visible indicators of compromise. This case underscores why hardware provenance and pre-deployment security validation are critical components of any procurement process.
Tactical Insight
Immediate actions
- Audit all network edge devices and routers to identify ZBT-manufactured hardware, including white-label variants, and isolate them from critical network segments immediately.
- Block unexpected outbound connections from routers using firewall rules or upstream traffic inspection to detect active backdoor communication.
Long-term improvements
- Establish a hardware procurement policy that requires vendors to provide a Software Bill of Materials (SBOM) and third-party security attestations before purchase.
- Maintain an accurate, up-to-date inventory of all network appliances including manufacturer origin, firmware version, and end-of-life status.
- Prefer routers and network hardware from vendors with transparent, auditable firmware and a published CVE disclosure program.
Detection measures
- Deploy network traffic monitoring (NDR/IDS) at the perimeter to flag anomalous outbound traffic patterns originating from infrastructure devices.
- Regularly perform firmware integrity checks against known-good hashes to detect unauthorized modifications or pre-installed implants.