If you think your organisation's biggest cybersecurity threat lives inside your servers or endpoints, think again. The humble router — the device quietly humming at the edge of your network — has become ground zero in one of the most alarming cybersecurity stories of 2025 and 2026. Security researchers have uncovered factory-installed surveillance backdoors hidden deep inside the firmware of Chinese-manufactured routers, sold worldwide under dozens of brand names. For IT and security teams, this isn't a theoretical risk. It's an active, documented threat that demands immediate attention.

What Was Actually Discovered?

Security researchers have discovered three pre-installed backdoor implants hidden inside firmware for widely distributed Chinese-made routers, exposing global networks to unauthorized remote hijacking. The findings focus on hardware manufactured by Shenzhen Zhibotong Electronics, commonly known as ZBT, which builds networking gear sold globally under dozens of brand names.

The research, published by security firm VulnCheck, began with a Zbtlink AX3000 router. Researchers found that its firmware contained an implant that they dubbed ENDLESSDOORS, as it automatically phones home to a command-and-control server and can execute arbitrary commands as root.

The scale of exposure is significant.

VulnCheck estimates at least 100,000 affected routers are deployed worldwide in homes, small businesses, and office environments.

The backdoor reportedly contacts a Chinese-registered domain and specific IP address every 35 seconds without user awareness.

But ENDLESSDOORS is only the beginning.

A Closer Look at the Three Backdoor Implants

ENDLESSDOORS: The Silent Phone-Home

ENDLESSDOORS is essentially a remote-control system embedded directly into the router's firmware. It starts automatically at boot and disguises itself as a normal Linux kernel process called kworker. The router periodically connects to a hard-coded server and announces itself. There's no meaningful authentication or encryption involved. Commands received from the server are passed directly to a shell running as root, and the implant can also establish an interactive root shell.

VulnCheck demonstrated the problem by impersonating the command server and taking control of its own test router. In other words, this isn't merely a theoretical vulnerability; if an attacker can hijack the connection to the implant's command server, they can obtain complete control of the router.

DARKLANTERN: Exposed Across 22 Countries

Researchers found that the backdoor's security mechanisms could be trivially bypassed: its command payload checksum relies on a static, hardcoded salt, and its internal MAC address filter can be entirely circumvented simply by submitting a MAC field of all zeroes. This allows any remote attacker to easily forge a packet and execute arbitrary commands as root.

VulnCheck scanned the internet and found 203 exposed DARKLANTERN instances in 22 countries, spread across 16 router models.

SPEAKINGSTONE: The Most Alarming of All

SPEAKINGSTONE is even more concerning. Rather than waiting for an attacker to connect to a listening port, it runs as the yunmgrd service and periodically beacons outbound to ZBT's command-and-control infrastructure over UDP port 10000.

The researchers say that it poses the biggest risk yet seen because it initiates the contact with its command and control servers.

When confronted,

a spokesperson for the Chinese router manufacturer told The Hacker News that the feature is "solely intended" for after-sales maintenance and serves no other purposes, and that "it is generally retained only on sample units to assist customers with software debugging."

Independent analysis, however, told a very different story.

The Bigger Picture: State-Sponsored Threats and the Typhoon Campaigns

This latest discovery doesn't exist in a vacuum. It's part of a broader and deeply concerning pattern of Chinese state-linked actors exploiting router vulnerabilities to compromise Western networks at scale.

Salt Typhoon, first publicly disclosed in late 2024, compromised the networks of AT&T, Verizon, and T-Mobile, among other carriers, giving Chinese intelligence operatives access to call records, text messages, and in some cases real-time communications of senior government officials and political figures.

Flax Typhoon operated a massive botnet comprising hundreds of thousands of compromised consumer routers, primarily TP-Link devices, which were used for distributed denial-of-service attacks, credential spraying, and as anonymous proxies for espionage operations. The FBI disrupted the botnet in September 2024, but security researchers have noted that replacement botnets using similar techniques emerged within months.

Volt Typhoon proxies all its network traffic to its targets through compromised SOHO network edge devices including routers.

Volt Typhoon, attributed to China's People's Liberation Army, targeted critical infrastructure systems including water treatment facilities, electrical grids, and transportation networks across the United States.

Compromised routers can enable in-depth network surveillance, data exfiltration, botnet attacks, and unauthorized access.

This is not a niche problem for national security agencies alone — it is a corporate and enterprise IT emergency.

The White-Label Problem: You May Not Know What You're Running

One of the most insidious aspects of this threat is how difficult it is to identify affected devices.

A major challenge to avoiding these kinds of embedded malware threats is that so many Chinese-made routers are sold under different brands, sometimes with different claimed countries of origin.

Factory-installed backdoors in white-labeled routers present serious supply chain vulnerabilities that require aggressive hardware auditing and network segmentation.

A router your organisation purchased under a trusted-looking brand name may, in reality, be ZBT hardware running compromised firmware under the hood.

Organisations must look beyond consumer branding to verify hardware origins and isolate vulnerable edge hardware before deployment.

Regulatory Response: Governments Are Taking Action

Regulators are beginning to catch up.

The Federal Communications Commission prohibited foreign-adversary controlled networking equipment from being used in U.S. IT infrastructure

in March 2026.

The FCC said in a March 23 statement that foreign-made routers had been exploited by malicious actors to target U.S. households, disrupt networks, conduct espionage, and steal intellectual property.

The discovery comes amid increasing Western scrutiny of Chinese technology products and follows a series of regulatory actions in the United States targeting foreign-made networking devices over national security concerns.

While regulatory action is a positive step, compliance timelines are often slow. IT teams cannot afford to wait.

Practical Tips: What IT Teams Must Do Right Now

The threat is real, the affected devices are already deployed, and the attack surface is wider than most organisations realise. Here's a concrete action plan:

1. Audit Your Network Hardware Immediately

VulnCheck published a list of 20 affected models and urged organisations to determine whether any remain deployed in their networks.

Cross-reference this list against your asset inventory. Don't assume your router's brand name reflects its manufacturer.

2. Replace Affected Devices Where Possible

VulnCheck recommended replacing affected devices where possible, restricting remote management access, and installing firmware updates if security fixes become available.

If replacement isn't immediately feasible, isolate suspect devices from sensitive network segments as a priority.

3. Monitor for Anomalous Outbound Traffic

Network defenders should monitor network devices for unauthorized downloads of bootloaders and firmware images and reboots. Network defenders should also monitor for unusual traffic destined to the router, including SSH.

Traffic beaconing out every 35 seconds to foreign IP addresses should be a hard red flag.

4. Implement Network Segmentation

Reducing lateral movement by taking particular networks offline to segregate them helps mitigate sideways attacks, and bolstering logon methods to include more robust multifactor authentication also helps reduce this risk.

Assume a compromised edge device and design your network accordingly.

5. Enforce Strong Authentication and Access Controls

Implement a centralised identity and access management (IAM) system with robust multifactor authentication (MFA) and granular role-based access control (RBAC) for managing network devices.

Default credentials on routers remain one of the most exploited entry points.

6. Establish a Configuration Management Programme

Implement network configuration management that supports configuration validation against defined templates and standards, with the ability to automatically remediate deviations or trigger alerts for manual intervention.

Any drift from a known-good baseline on a router should trigger an immediate investigation.

7. Vet Your Hardware Supply Chain
Before procuring any new networking hardware, research the original equipment manufacturer (OEM), not just the retailer brand. Require vendors to provide verifiable firmware provenance and security certifications. Make supply chain transparency a mandatory procurement criterion.

Conclusion: The Edge of Your Network Is the Front Line

The discovery of ENDLESSDOORS, SPEAKINGSTONE, and DARKLANTERN is a watershed moment for enterprise network security. It confirms what security researchers have warned for years: the router is not a passive piece of infrastructure — it is a high-value target, and in some cases, a pre-compromised weapon already sitting inside your perimeter.

The Typhoon campaigns, the FCC's regulatory crackdown, and now VulnCheck's detailed technical findings all point to the same conclusion: Chinese-made routers represent a documented, escalating, and immediate cybersecurity risk. Dismissing it as a geopolitical issue rather than an IT one is no longer an option.

Your next step starts today. Audit your hardware, review your supply chain, segment your network, and replace any device you cannot fully trust. If your organisation needs expert guidance on conducting a network security audit, assessing router firmware integrity, or implementing a zero-trust architecture for your edge devices — now is the time to act. Don't wait for a breach to discover what's already on your network.