ZBT Router SPEAKINGSTONE and DARKLANTERN Threat Hunt

Threat Overview

VulnCheck disclosed two previously undocumented remote-management components embedded in firmware for routers manufactured by Shenzhen Zhibotong Electronics (ZBT) and related rebranded hardware. CVE-2026-74232 tracks SPEAKINGSTONE, a yunmgrd cloud component that beacons over UDP/10000 and can receive privileged instructions. CVE-2026-74233 tracks DARKLANTERN, an infosrvd service that listens on UDP/9992 and permits unauthenticated privileged command execution.

VulnCheck sinkholed SPEAKINGSTONE’s unregistered backup domain and observed hundreds of routers beaconing, almost all from China. The research establishes that affected firmware shipped with these capabilities; it does not establish that every device was actively controlled by a malicious operator.

References

Impacted Systems

Vendor / ecosystem	ZBT / Zbtlink, MoreQuick, and rebranded hardware using affected MQWrt firmware
CVE-2026-74232	SPEAKINGSTONE / yunmgrd outbound cloud-control component
Representative affected CVE-2026-74232 models	ZBT WE826-T2 <=19.1101; L3_V2_8 <=3.0.0.4.528; ZBT-7628 <=1.0.0.2.007; ZBT-ZBT7621 <=1.0.0.3.001; MoreQuick MQAC/MQAP 7620/7628 families and additional models listed by VulnCheck
CVE-2026-74233	DARKLANTERN / infosrvd unauthenticated command interface over UDP/9992
Representative affected CVE-2026-74233 models	WE1326 <=19.1101; WE2426-C <=19.1112; WE357/WE5926/WE826/WG families and additional models listed by VulnCheck
Network indicators	UDP/10000 outbound; UDP/9992 inbound; UDP/8897 responses
Exposure condition	DARKLANTERN-compatible firmware permits Internet-reachable UDP/9992; SPEAKINGSTONE phones home through NAT
Patch status	No universal fixed version was established across the affected multi-brand firmware population in the reviewed research

What this hunt looks for

Looks for UDP/9992, UDP/8897, and UDP/10000 traffic, DNS requests for the confirmed SPEAKINGSTONE infrastructure, and network-device syslog indicators tied to yunmgrd or infosrvd.

Required logs

CommonSecurityLog from firewalls/network devices; DNS telemetry such as DnsEvents or ASimDnsActivityLogs; and Syslog from network devices where available.

First-Pass — ZBT Implant Network Ports

CommonSecurityLog
| where TimeGenerated >= ago(30d)
| where Protocol =~ "UDP"
| where DestinationPort in (9992, 10000) or SourcePort == 9992 and DestinationPort == 8897
| project TimeGenerated, DeviceVendor, DeviceProduct, SourceIP, SourcePort, DestinationIP, DestinationPort, DeviceAction, Message
| sort by TimeGenerated asc

IOC — SPEAKINGSTONE C2 Domains in DNS

let Domain1 = strcat("www.ac-link", ".com");
let Domain2 = strcat("ac-link", ".com");
let Domain3 = strcat("www.findmyipaddr", ".com");
let Domain4 = strcat("findmyipaddr", ".com");
union isfuzzy=true
(
    DnsEvents
    | project TimeGenerated, QueryName=Name, ClientIP=ClientIP, SourceTable="DnsEvents"
),
(
    ASimDnsActivityLogs
    | project TimeGenerated, QueryName=DnsQuery, ClientIP=SrcIpAddr, SourceTable="ASimDnsActivityLogs"
)
| where QueryName in~ (Domain1, Domain2, Domain3, Domain4)
| project TimeGenerated, SourceTable, ClientIP, QueryName
| sort by TimeGenerated asc

Follow-Up — Network Syslog for ZBT Indicators

Syslog
| where TimeGenerated >= ago(30d)
| where SyslogMessage has_any ("9992", "10000", "8897", "ac-link", "findmyipaddr", "yunmgrd", "infosrvd")
| project TimeGenerated, Computer, HostIP, ProcessName, SeverityLevel, SyslogMessage
| sort by TimeGenerated asc