QTYF built and ran the scanning and routing frameworks other Chinese teams pointed at U.S. critical infrastructure. That means the proxy addresses and scan fingerprints in your logs point to the supplier; the intruder behind them stays unnamed.
Perspective Coverage
3 publishers
- Builder
- Builder 23%
- Operator
- Operator 58%
- Investor
- Investor 19%
Reality
- Evidence55
- Adoption
- Insufficient
- Hype gap+10
- Incentives
- Insufficient
- Confidence60
buildOne report1 publisher VulnCheck says SPEAKINGSTONE beacons as root over cleartext UDP with no authentication. Control passes to anyone who occupies that channel, and a second implant in the same firmware image turned up in 22 countries.
Publishers:docs.vulncheck.com
Reality
- Evidence58
- Adoption40
- Hype gap+12
- Incentives76
- Confidence55
buildOne report1 publisher VulnCheck's ENDLESSDOORS ships enabled on more than 20 Zbtlink models and runs as root from boot, and because it opens no port at all, the check that would have caught it has to happen on the firmware image.
Publishers:docs.vulncheck.com
Reality
- Evidence58
- Adoption32
- Hype gap+18
- Incentives74
- Confidence52
VulnCheck rooted a Deep Orange LTE router sold by a US supplier and found a WAN-facing backdoor listening on UDP 9992, plus a hard-coded checksum key that names the Chinese OEM behind the firmware.
Reality
- Evidence72
- Adoption55
- Hype gap+10
- Incentives68
- Confidence60
buildConfirmed2 publishers VulnCheck found a root command channel in ZBT-derived OEM firmware that the default WAN firewall leaves open. Only the board ID and the firmware hash tell you whether your branch office is running it.
Reality
- Evidence72
- Adoption66
- Hype gap+16
- Incentives55
- Confidence68
SPEAKINGSTONE and DARKLANTERN both hand unauthenticated attackers root on ZBT-built hardware, and because neither advisory names a fixed firmware release, the remedy for an affected model is replacing it.
Reality
- Evidence64
- Adoption38
- Hype gap+12
- Incentives72
- Confidence62