VulnCheck Finds Surveillance Backdoors in Zbtlink Routers

Cybersecurity firm VulnCheck discovered surveillance backdoors in routers manufactured by Shenzhen Zhibotong Electronics, also known as Zbtlink. The researchers identified two distinct hidden programs: Speakingstone and Darklantern. Speakingstone allows remote servers to redirect network traffic and steal credentials, while Darklantern enables unauthorized administrator-level access without requiring a password.

VulnCheck identified 203 Darklantern-infected routers accessible via the internet across 22 countries, with 103 of those devices located in the United States. Speakingstone was found active on 392 routers, primarily in China and connected through China Mobile. Researchers noted that these findings align with Chinese laws that require telecommunications companies to provide technical assistance to state security agencies.

This discovery follows a March 2026 decision by the Federal Communications Commission to restrict the approval of new foreign-made consumer routers. That move was driven by national security concerns and documented links to cyber campaigns targeting United States infrastructure.