DARKLANTERN

Codename for the infosrvd listener on UDP/9992, reachable from the WAN by default and accepting root commands via command type 0x17.

Known aliases

infosrvd
revProto

Current stories

securityConfirmed2 publishers

FBI disrupts the Nanjing contractor that sold QScan and QTRouter to Chinese espionage operators

QTYF built and ran the scanning and routing frameworks other Chinese teams pointed at U.S. critical infrastructure. That means the proxy addresses and scan fingerprints in your logs point to the supplier; the intruder behind them stays unnamed.

Publishers:news.risky.biz risky.biz thehackernews.com

Perspective Coverage

3 publishers

Builder: Builder 23%
Operator: Operator 58%
Investor: Investor 19%

Reality

Evidence55
Adoption: Insufficient
Hype gap+10
Incentives: Insufficient
Confidence60

buildOne report1 publisher

A root implant in ZBT router firmware takes orders from whoever holds the C2 position

VulnCheck says SPEAKINGSTONE beacons as root over cleartext UDP with no authentication. Control passes to anyone who occupies that channel, and a second implant in the same firmware image turned up in 22 countries.

Publishers:docs.vulncheck.com

Reality

Evidence58
Adoption40
Hype gap+12
Incentives76
Confidence55

productOne report1 publisher

Two Nim implants shipped inside a US-branded router VulnCheck bought on Amazon

VulnCheck rooted a Deep Orange LTE router sold by a US supplier and found a WAN-facing backdoor listening on UDP 9992, plus a hard-coded checksum key that names the Chinese OEM behind the firmware.

Publishers:vulncheck.com

Reality

Evidence72
Adoption55
Hype gap+10
Incentives68
Confidence60

buildConfirmed2 publishers

An all-zero MAC address bypasses the root command check in ZBT-derived white-label routers

VulnCheck found a root command channel in ZBT-derived OEM firmware that the default WAN firewall leaves open. Only the board ID and the firmware hash tell you whether your branch office is running it.

Publishers:dev.to tomshardware.com

Reality

Evidence72
Adoption66
Hype gap+16
Incentives55
Confidence68

securityOne report1 publisher

ZBT router firmware ships two factory implants that beacon out on UDP/10000

SPEAKINGSTONE and DARKLANTERN both hand unauthenticated attackers root on ZBT-built hardware, and because neither advisory names a fixed firmware release, the remedy for an affected model is replacing it.

Publishers:thehackernews.com

Reality

Evidence64
Adoption38
Hype gap+12
Incentives72
Confidence62