VulnCheck researchers discovered three remote-access implants (ENDLESSDOORS, DARKLANTERN, SPEAKINGSTONE) embedded in firmware from Shenzhen ZBT Electronics routers sold globally under many brand names. ENDLESSDOORS masquerades as a kernel process, beacons home over unencrypted channels, and accepts unauthenticated root commands. DARKLANTERN listens on UDP 9992 with trivial-to-bypass auth using hardcoded salts and zeroed MAC fields. SPEAKINGSTONE beacons outbound to command servers and can steal credentials, modify DNS, and establish reverse tunnels. The researchers registered an abandoned backup domain, caught 392 devices calling home (390 in China on China Mobile), and demonstrated active exploitability by hijacking test routers. The source notes ZBT manufactures under dozens of OEM/ODM labels (Lippert, Wave WiFi, Deep Orange, Digineo, etc.), making origin opaque to end users. ZBT claims these are "after-sales support," but researchers argue the lack of meaningful authentication makes them exploitable by any attacker who can intercept communications. Factory-installed implants mean firmware replacement won't help. The source emphasizes this extends beyond ZBT-branded boxes—any cheap cellular or travel router from obscure OEMs warrants suspicion.