Two Nim implants shipped inside a US-branded router VulnCheck bought on Amazon

A router with an English brand name, bought from a US seller and installed in a branch office, gave its owner no reason to look at UDP 9992. That is where DARKLANTERN listens, running as a service called infosrvd, and according to VulnCheck the router's default firewall explicitly accepts inbound packets to that port from anywhere on the internet ^[10].

The protocol, which the binary internally calls revProto, is unauthenticated and unencrypted, with two packet types ^[11]. The first is a 19-byte info probe: send it to UDP 9992 and the device answers on UDP 8897 with its model, firmware version, MAC address, uptime and other identifying fields ^[12]. VulnCheck published one such reply from a device in Ukraine with the model, MAC, SSID and public IP all in the clear ^[13]. The second is a command packet, type 0x17, whose payload is handed to system("/etc/exec/cmd " + payload), where a semicolon escapes the fixed prefix and there is no length limit and no character filtering ^[14]. VulnCheck's own summary of that: one packet for a root shell over the internet ^[19].

Two fields are supposed to gate the command packet. The first is a four-byte checksum, taken as the last four hex characters of md5 over the string "mqonu.com" plus the payload, with the key hard-coded in the backdoor and therefore unchangeable, so anyone who reads the binary can compute a valid token for any payload ^[15]. Four hex characters is 16 bits, which leaves 65,536 candidate values for someone who never recovered the key at all ^[20]. The second gate compares a six-byte MAC field against /tmp/mac.txt and drops mismatches, a check that the 19-byte probe undercuts by returning the device's MAC on request ^[17], and VulnCheck reports a hard-coded bypass in the check as well ^[18].

The string "mqonu.com" is never contacted. VulnCheck reads it as a reference to MoreQuick, the Chinese OEM that developed the firmware for this ZBT-WE826-T2, which makes the salt a provenance marker rather than a network artifact ^[16]. Both implants are written in Nim, both communicate over UDP, and both are launched by the same binary, a connectivity watchdog called inetdetect ^[9]. The launcher wears a plausible utility name. The identity of the firmware author sits inside a hash salt instead of on the label.

Buyers who order network hardware actually check the brand, the seller's location, maybe a spec sheet. Teams tell themselves those things establish custody over the code that ships. Sorting a fleet takes two questions, neither about the badge. Can anyone name the firm that wrote the firmware, and can anyone get a shell on a sample unit and enumerate what it listens on. Both answers yes, and there is something to govern. Knowing the OEM without being able to inspect the unit just means trusting a company the buyer never selected. Being able to inspect the unit without knowing the OEM means each firmware update resets the evidence. Without either, the brand name is carrying the whole assurance argument. Here that amounts to a sticker over someone else's firmware.