aviatrix logoAviatrix
Under Active Attack

Executive Summary

In August 2026, security researchers discovered that Shenzhen Zhibotong Electronics Co. Ltd. (ZBT), a major Chinese router manufacturer, had embedded multiple backdoors in firmware across millions of white-label routers sold globally. The backdoors, dubbed 'EndlessDoors,' 'SpeakingStone,' and 'DarkLantern,' provided root-level access and command-and-control capabilities to attackers. With ZBT producing 3.57 million units annually and exporting to over 50 countries including the US, Canada, Germany, and Australia, the supply chain compromise potentially affected hundreds of thousands of edge devices in critical infrastructure, corporate networks, and remote installations like oil pipelines. This incident exemplifies the growing threat of nation-state supply chain attacks targeting network infrastructure, particularly as organizations increasingly deploy edge devices with cellular connectivity in remote locations that are difficult to monitor and update.

Why This Matters Now

Supply chain attacks on network infrastructure have escalated dramatically, with nation-state actors embedding persistent backdoors in widely-distributed hardware. This ZBT incident demonstrates how compromised edge devices can provide long-term espionage capabilities and lateral movement opportunities across global networks.

Attack Path Analysis

MITRE ATT&CK® Techniques

Potential Compliance Exposure

Sector Implications

Sources

Frequently Asked Questions

Organizations should look for two specific hardware MAC addresses allocated to ZBT and immediately disconnect and replace any identified devices, as the backdoors provide root-level access.

Cloud Native Security Fabric Mitigations and ControlsCNSF

Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.

Aviatrix Zero Trust CNSF would constrain the blast radius of compromised edge routers through network segmentation and controlled traffic flows. While the initial hardware compromise cannot be prevented, CNSF would likely limit lateral movement and reduce the scope of network reconnaissance and data exfiltration.

Initial Compromise

Control: Cloud Native Security Fabric (CNSF)

Mitigation: CNSF would likely constrain the compromised router's ability to access internal cloud workloads through network segmentation boundaries, reducing the device's effective reach into protected environments

Privilege Escalation

Control: Zero Trust Segmentation

Mitigation: Zero Trust segmentation would likely contain privilege escalation attempts by restricting cross-zone access, reducing the attacker's ability to leverage router privileges for accessing segmented workloads and services

Lateral Movement

Control: East-West Traffic Security

Mitigation: East-west traffic enforcement would likely constrain lateral movement by blocking unauthorized inter-workload communications, reducing the attacker's ability to pivot through internal network segments from the compromised edge device

Command & Control

Control: Multicloud Visibility & Control

Mitigation: Multicloud visibility would likely detect and constrain C2 communications through traffic analysis and anomaly detection, reducing the effectiveness of persistent command channels across cloud environments

Exfiltration

Control: Egress Security & Policy Enforcement

Mitigation: Egress policy enforcement would likely constrain data exfiltration by controlling outbound traffic flows and blocking unauthorized data transfers, reducing the volume and types of information that could be extracted

Impact (Mitigations)

Residual impact would likely be constrained to the local network segment containing the compromised router, with reduced ability to affect segmented cloud workloads and protected data flows

Impact at a Glance

Affected Business Functions

  • Network Infrastructure Operations
  • Internet Connectivity Services
  • Remote Site Monitoring
  • Telecommunications Infrastructure
Operational Disruption

Estimated downtime: 7 days

Financial Impact

Estimated loss: N/A

Data Exposure

Potential exposure includes network traffic metadata, user credentials, DNS queries, system telemetry data, and GPS coordinates of router locations. The backdoors enabled root-level access allowing complete surveillance of network communications and potential lateral movement into connected networks.

Recommended Actions

  • • Implement Zero Trust Segmentation to prevent compromised edge devices from accessing internal networks through microsegmentation and identity-based policy enforcement
  • • Deploy Multicloud Visibility & Control to detect anomalous beacon traffic and suspicious automation patterns from edge devices to external domains
  • • Establish Egress Security & Policy Enforcement with FQDN filtering to block unauthorized outbound connections from network infrastructure to unknown C2 domains
  • • Enable East-West Traffic Security monitoring to detect lateral movement attempts from compromised edge devices into workload-to-workload communications
  • • Activate Threat Detection & Anomaly Response capabilities to baseline normal edge device behavior and alert on covert communication tools and remote access patterns

Secure the Paths Between Cloud Workloads

A cloud-native security fabric that enforces Zero Trust across workload communication—reducing attack paths, compliance risk, and operational complexity.

Stop Advanced ThreatsGet a Free Workload Attack Path AssessmentUnder Active Attack?
Cta pattren Image