From zdnet.com
A security researcher has created a proof-of-concept backdoor inspired by the NSA malware that leaked online in the spring of 2017.
This new malware is named SMBdoor and is the work of RiskSence security researcher Sean Dillon (@zerosum0x0).
Dillon designed SMBdoor as a Windows kernel driver that once installed on a PC will abuse undocumented APIs in the srvnet.sys process to register itself as a valid handler for SMB (Server Message Block) connections.
The malware is very stealthy, as it doesn’t bind to any local sockets, open ports, or hooks into existing functions, and by doing so avoiding triggering alerts for some antivirus systems.
Its design was inspired by similar behavior that Dillon has seen in DoublePulsar and DarkPulsar, two malware implants designed by the NSA that were leaked online by a nefarious hacking group known as The Shadow Brokers.