VulnCheck disclosed two factory-embedded implants in ZBT (Shenzhen Zhibotong Electronics) router firmware. SPEAKINGSTONE (CVE-2026-74232) runs as service 'yunmgrd' and sends UDP beacons on port 10000 to a hardcoded C2 server (www.ac-link[.]com, IP 47.107.224[.]89 on Alibaba Cloud in Shenzhen). It supports arbitrary root command execution, WAN PPPoE credential exfiltration, DNS hijack list read/write, and reverse SSH tunnel establishment. It operates behind NAT via outbound connections. A backup C2 domain (www.findmyipaddr[.]com) was found unregistered; VulnCheck registered it and observed 392 unique beaconing devices, 390 in China, 83% on China Mobile, 304 broadcasting SSIDs starting with 'CMCC', and 363 self-reporting model L3_V2_8 on firmware 3.0.0.4.528. DARKLANTERN (CVE-2026-74233) runs as service 'infosrvd' on UDP port 9992, open to all inbound internet connections by the router's stock firewall. Its authentication is bypassed via a hardcoded salt and all-zero wildcard MAC address. Between August 18-21, 203 internet-facing DARKLANTERN instances were found across 22 countries across 16 self-reported models. Both implants were found on an $88 Deep Orange 3G/4G/LTE Router (white-labeled ZBT-WE826-T2) with 2019 firmware purchased from a US supplier. Both CVEs are rated 9.3 on CVSS 4.0 and 9.8 on CVSS 3.1, requiring no privileges or user interaction over the network. VulnCheck flagged CVE-2026-74233 in its Known Exploited Vulnerabilities catalog. No fixed firmware release has been published. MAC address prefixes 78:A3:51 and F8:5E:3C are assigned to Shenzhen Zhibotong Electronics. Third-party firmware (e.g., MOFI Network) for the same platform was found free of all three implants. Suricata and YARA detection rules were published, though a discrepancy exists between port 8897 and 8898 in the rules vs. documentation.