QTYF built and ran the scanning and routing frameworks other Chinese teams pointed at U.S. critical infrastructure. That means the proxy addresses and scan fingerprints in your logs point to the supplier; the intruder behind them stays unnamed.
Perspective Coverage
3 publishers
- Builder
- Builder 23%
- Operator
- Operator 58%
- Investor
- Investor 19%
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+10
- Incentives
- Not scored
- Confidence60
buildOne report1 publisher A root implant in ZBT router firmware takes orders from whoever holds the C2 position
VulnCheck says SPEAKINGSTONE beacons as root over cleartext UDP with no authentication. Control passes to anyone who occupies that channel, and a second implant in the same firmware image turned up in 22 countries.
Publishers:docs.vulncheck.com
Reality
- Evidence58
- Adoption40
- Hype gap+12
- Incentives76
- Confidence55
buildOne report1 publisher Answering one hardcoded address gives you root on 20+ Zbtlink router models
VulnCheck's ENDLESSDOORS ships enabled on more than 20 Zbtlink models and runs as root from boot, and because it opens no port at all, the check that would have caught it has to happen on the firmware image.
Publishers:docs.vulncheck.com
Reality
- Evidence58
- Adoption32
- Hype gap+18
- Incentives74
- Confidence52
Two Nim implants shipped inside a US-branded router VulnCheck bought on Amazon
VulnCheck rooted a Deep Orange LTE router sold by a US supplier and found a WAN-facing backdoor listening on UDP 9992, plus a hard-coded checksum key that names the Chinese OEM behind the firmware.
Reality
- Evidence72
- Adoption55
- Hype gap+10
- Incentives68
- Confidence60
buildConfirmed2 publishers VulnCheck found a root command channel in ZBT-derived OEM firmware that the default WAN firewall leaves open. Only the board ID and the firmware hash tell you whether your branch office is running it.
Reality
- Evidence72
- Adoption66
- Hype gap+16
- Incentives55
- Confidence68
ZBT router firmware ships two factory implants that beacon out on UDP/10000
SPEAKINGSTONE and DARKLANTERN both hand unauthenticated attackers root on ZBT-built hardware, and because neither advisory names a fixed firmware release, the remedy for an affected model is replacing it.
Reality
- Evidence64
- Adoption38
- Hype gap+12
- Incentives72
- Confidence62