Chinese Routers Sold Worldwide Contain Backdoors

Chinese router manufacturer Shenzhen Zhibotong Electronics Co. Ltd. (ZBT) has been selling routers containing multiple backdoors, some dating back a decade, to white-label distributors worldwide. These backdoors, including EndlessDoors, SpeakingStone, and DarkLantern, allow remote access and control of infected devices, potentially enabling espionage and data theft. Despite ZBT’s attempts to halt sales and release firmware updates, infected routers remain widely available on marketplaces like Amazon and Alibaba. The scope of the issue is difficult to determine, but estimates suggest potentially hundreds or even thousands of infected devices globally, particularly in countries like the US, Russia, and China. Organizations need to proactively identify ZBT-branded devices and consider replacing them.