{"id":26965,"date":"2019-04-24T23:23:01","date_gmt":"2019-04-24T23:23:01","guid":{"rendered":"http:\/\/ee136bf7-e88a-4216-a91d-ad1b62252ad3"},"modified":"2019-04-24T23:23:01","modified_gmt":"2019-04-24T23:23:01","slug":"security-researcher-creates-new-backdoor-inspired-by-leaked-nsa-malware","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/security-researcher-creates-new-backdoor-inspired-by-leaked-nsa-malware\/","title":{"rendered":"Security researcher creates new backdoor inspired by leaked NSA malware"},"content":{"rendered":"<p><a rel=\"nofollow\" href=\"https:\/\/www.zdnet.com\/article\/security-researcher-creates-new-backdoor-inspired-by-leaked-nsa-malware\/#modal-absolute-c97e736b-d355-4485-8c78-5024e5c9e625\" data-open=\"modal\"><span class=\"img aspect-set\"><img decoding=\"async\" src=\"https:\/\/zdnet4.cbsistatic.com\/hub\/i\/2019\/04\/24\/c97e736b-d355-4485-8c78-5024e5c9e625\/4aacce3c0847c4dafd2ea8a33b81d9e9\/smbdoor.jpg\" class alt=\"SMBdoor\"><\/span><\/a><\/p>\n<div class=\"modal infographic\" id=\"modal-absolute-c97e736b-d355-4485-8c78-5024e5c9e625\">\n<div class=\"modal-body\"><span class=\"img\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/zdnet3.cbsistatic.com\/hub\/i\/r\/2019\/04\/24\/c97e736b-d355-4485-8c78-5024e5c9e625\/resize\/1170x878\/7d6c871f1bca6c0e843352799d2cc7a4\/smbdoor.jpg\" class alt height=\"878\" width=\"1170\"><\/span><\/div>\n<\/div>\n<p>A security researcher has created a proof-of-concept backdoor inspired by the NSA malware that leaked online in the spring of 2017.<\/p>\n<p>This new malware is named SMBdoor and is the work of RiskSence security researcher Sean Dillon (<a href=\"https:\/\/twitter.com\/zerosum0x0\" target=\"_blank\" rel=\"noopener noreferrer\">@zerosum0x0<\/a>).<\/p>\n<p>Dillon designed SMBdoor as a Windows kernel driver that once installed on a PC will abuse undocumented APIs in the <a href=\"https:\/\/www.file.net\/process\/srvnet.sys.html\" target=\"_blank\" rel=\"noopener noreferrer\">srvnet.sys<\/a> process to register itself as a valid handler for <a href=\"https:\/\/en.wikipedia.org\/wiki\/Server_Message_Block\" target=\"_blank\" rel=\"noopener noreferrer\">SMB<\/a> (Server Message Block) connections.<\/p>\n<p>The malware is very stealthy, as it doesn&#8217;t bind to any local sockets, open ports, or hooks into existing functions, and by doing so avoiding triggering alerts for some antivirus systems.<\/p>\n<p>Its design was inspired by similar behavior that Dillon has seen in <a href=\"https:\/\/www.rapid7.com\/security-response\/doublepulsar\/\" target=\"_blank\" rel=\"noopener noreferrer\">DoublePulsar<\/a> and <a href=\"https:\/\/www.zdnet.com\/article\/kaspersky-says-it-detected-infections-with-darkpulsar-alleged-nsa-malware\/\" target=\"_blank\">DarkPulsar<\/a>, two malware implants designed by the NSA that were leaked online by a nefarious hacking group known as The Shadow Brokers.<\/p>\n<h3>Not weaponized<\/h3>\n<p>But some users might ask themselves &#8211;why did a security researcher create malware, in the first place?<\/p>\n<p>In an interview with <em>ZDNet<\/em> today, Dillon told us that the SMBdoor code is not weaponized, and that cybercriminals can&#8217;t download it from <a href=\"https:\/\/github.com\/zerosum0x0\/smbdoor\" target=\"_blank\" rel=\"noopener noreferrer\">GitHub<\/a> and infect users in the same way they can download and deploy versions of the NSA&#8217;s DoublePulsar out of the box.<\/p>\n<section class=\"sharethrough-top\" data-component=\"medusaContentRecommendation\" data-medusa-content-recommendation-options=\"{&quot;promo&quot;:&quot;promo_ZD_recommendation_sharethrough_top_in_article_desktop&quot;,&quot;spot&quot;:&quot;dfp-in-article&quot;}\">\n<\/section>\n<p>&#8220;[SMBdoor] comes with practical limitations that make it mostly an academic exploration, but I thought it might be interesting to share, and is possibly something [endpoint detection and response, aka antivirus] products should monitor,&#8221; Dillon said.<\/p>\n<p>&#8220;There are limitations in the proof-of-concept that an attacker would have to overcome,&#8221; he added. &#8220;Most importantly, modern Windows attempts to block unsigned kernel code.<\/p>\n<p>&#8220;There are also secondary complications the backdoor would have to account for, during the process of loading secondary payloads, in order to use paged memory and not deadlock the system,&#8221; Dillon said.<\/p>\n<p>&#8220;Both of these issues have several well-known bypasses, but they do become even more difficult when modern mitigations such as Hyper-V Code Integrity are enabled.&#8221;<\/p>\n<p>Dillon said that unless an attacker values stealth more than the effort needed to modify SMBdoor, then this experimental malware isn&#8217;t very useful to anyone.<\/p>\n<h3>Stealthy by design<\/h3>\n<p>Dillon&#8217;s work on SMBdoor has caught the eye of many security researchers due to its stealthy design and the use of undocumented API functions.<\/p>\n<div class=\"twitterContainer\" readability=\"5.6510416666667\">\n<blockquote class=\"twitter-tweet\" readability=\"5.6510416666667\">\n<p lang=\"en\" dir=\"ltr\">This looks good, open source implant piggy backing on SMB (so no new ports opened) a la Doublepulsar. <a href=\"https:\/\/t.co\/yaxWBNLu4D\">https:\/\/t.co\/yaxWBNLu4D<\/a><\/p>\n<p>\u2014 Kevin Beaumont \ud83e\udddd\ud83c\udffd\u200d\u2640\ufe0f (@GossiTheDog) <a href=\"https:\/\/twitter.com\/GossiTheDog\/status\/1117357540868796417?ref_src=twsrc%5Etfw\">April 14, 2019<\/a><\/p><\/blockquote>\n<\/div>\n<p>&#8220;Like DOUBLEPULSAR, this implant hides in an esoteric area of the system,&#8221; Dillon told <em>ZDNet<\/em>.<\/p>\n<p>&#8220;Listening to network traffic over an already-bound port, without touching any sockets, is not well established in current methodologies and is part of an expanding research area.<\/p>\n<p>&#8220;While there may be places in the system a generic inline hook can accomplish a similar effect, this method is interesting because it instead hides out with the normal, core functionality of SMB.<\/p>\n<p>&#8220;It is an anomaly that requires custom and specific code to detect,&#8221; Dillon said.<\/p>\n<p>The researcher hopes that his work on SMBdoor will drive security software providers to improve their detections, and in the process, provide better protections to Windows users against SMBdoor, DoublePulsar, and DarkPulsar threats.<\/p>\n<p>Dillon work&#8217;s on analyzing the leaked NSA malware is well known among his peers. Previously, he <a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/nsa-exploits-ported-to-work-on-all-windows-versions-released-since-windows-2000\/\" target=\"_blank\" rel=\"noopener noreferrer\">ported the EternalChampion, EternalRomance, and EternalSynergy NSA exploits<\/a> to work on all Windows versions, going back to Windows 2000; he <a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/nsa-exploit-doublepulsar-patched-to-work-on-windows-iot-systems\/\" target=\"_blank\" rel=\"noopener noreferrer\">ported the DoublePulsar malware implant<\/a> to work on Windows-based IoT devices; and also <a href=\"https:\/\/www.bleepingcomputer.com\/news\/security\/researchers-port-nsa-eternalblue-exploit-to-windows-10\/\" target=\"_blank\" rel=\"noopener noreferrer\">ported the EternalBlue SMB exploit<\/a> (the one used by the WannaCry and NotPetya ransomware strains) to work on modern versions of Windows 10.<\/p>\n<h3>Related malware and cybercrime coverage:<\/h3>\n<p>READ MORE <a href=\"https:\/\/www.zdnet.com\/article\/security-researcher-creates-new-backdoor-inspired-by-leaked-nsa-malware\/#ftag=RSSbaffb68\">HERE<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>New experimental backdoor highlights an OS section that antivirus products are not looking at.<br \/>\nREAD MORE HERE&#8230;<\/p>\n","protected":false},"author":2,"featured_media":26966,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"colormag_page_layout":"default_layout","footnotes":""},"categories":[62],"tags":[],"class_list":["post-26965","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-zdnet-security"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.6 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Security researcher creates new backdoor inspired by leaked NSA malware 2026 | ThreatsHub Cybersecurity News<\/title>\n<meta name=\"description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.threatshub.org\/blog\/security-researcher-creates-new-backdoor-inspired-by-leaked-nsa-malware\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Security researcher creates new backdoor inspired by leaked NSA malware 2026 | ThreatsHub Cybersecurity News\" \/>\n<meta property=\"og:description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.threatshub.org\/blog\/security-researcher-creates-new-backdoor-inspired-by-leaked-nsa-malware\/\" \/>\n<meta property=\"og:site_name\" content=\"ThreatsHub Cybersecurity News\" \/>\n<meta property=\"article:published_time\" content=\"2019-04-24T23:23:01+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2019\/04\/security-researcher-creates-new-backdoor-inspired-by-leaked-nsa-malware.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1000\" \/>\n\t<meta property=\"og:image:height\" content=\"425\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"TH Author\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@threatshub\" \/>\n<meta name=\"twitter:site\" content=\"@threatshub\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"TH Author\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/security-researcher-creates-new-backdoor-inspired-by-leaked-nsa-malware\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/security-researcher-creates-new-backdoor-inspired-by-leaked-nsa-malware\\\/\"},\"author\":{\"name\":\"TH Author\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\"},\"headline\":\"Security researcher creates new backdoor inspired by leaked NSA malware\",\"datePublished\":\"2019-04-24T23:23:01+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/security-researcher-creates-new-backdoor-inspired-by-leaked-nsa-malware\\\/\"},\"wordCount\":618,\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/security-researcher-creates-new-backdoor-inspired-by-leaked-nsa-malware\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2019\\\/04\\\/security-researcher-creates-new-backdoor-inspired-by-leaked-nsa-malware.jpg\",\"articleSection\":[\"ZDNet | Security\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/security-researcher-creates-new-backdoor-inspired-by-leaked-nsa-malware\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/security-researcher-creates-new-backdoor-inspired-by-leaked-nsa-malware\\\/\",\"name\":\"Security researcher creates new backdoor inspired by leaked NSA malware 2026 | ThreatsHub Cybersecurity News\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/security-researcher-creates-new-backdoor-inspired-by-leaked-nsa-malware\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/security-researcher-creates-new-backdoor-inspired-by-leaked-nsa-malware\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2019\\\/04\\\/security-researcher-creates-new-backdoor-inspired-by-leaked-nsa-malware.jpg\",\"datePublished\":\"2019-04-24T23:23:01+00:00\",\"description\":\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/security-researcher-creates-new-backdoor-inspired-by-leaked-nsa-malware\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/security-researcher-creates-new-backdoor-inspired-by-leaked-nsa-malware\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/security-researcher-creates-new-backdoor-inspired-by-leaked-nsa-malware\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2019\\\/04\\\/security-researcher-creates-new-backdoor-inspired-by-leaked-nsa-malware.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2019\\\/04\\\/security-researcher-creates-new-backdoor-inspired-by-leaked-nsa-malware.jpg\",\"width\":1000,\"height\":425},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/security-researcher-creates-new-backdoor-inspired-by-leaked-nsa-malware\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Security researcher creates new backdoor inspired by leaked NSA malware\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"name\":\"ThreatsHub Cybersecurity News\",\"description\":\"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"alternateName\":\"Threatshub.org\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\",\"name\":\"ThreatsHub.org\",\"alternateName\":\"Threatshub.org\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"width\":432,\"height\":435,\"caption\":\"ThreatsHub.org\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/threatshub\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\",\"name\":\"TH Author\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"caption\":\"TH Author\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Security researcher creates new backdoor inspired by leaked NSA malware 2026 | ThreatsHub Cybersecurity News","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.threatshub.org\/blog\/security-researcher-creates-new-backdoor-inspired-by-leaked-nsa-malware\/","og_locale":"en_US","og_type":"article","og_title":"Security researcher creates new backdoor inspired by leaked NSA malware 2026 | ThreatsHub Cybersecurity News","og_description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","og_url":"https:\/\/www.threatshub.org\/blog\/security-researcher-creates-new-backdoor-inspired-by-leaked-nsa-malware\/","og_site_name":"ThreatsHub Cybersecurity News","article_published_time":"2019-04-24T23:23:01+00:00","og_image":[{"width":1000,"height":425,"url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2019\/04\/security-researcher-creates-new-backdoor-inspired-by-leaked-nsa-malware.jpg","type":"image\/jpeg"}],"author":"TH Author","twitter_card":"summary_large_image","twitter_creator":"@threatshub","twitter_site":"@threatshub","twitter_misc":{"Written by":"TH Author","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.threatshub.org\/blog\/security-researcher-creates-new-backdoor-inspired-by-leaked-nsa-malware\/#article","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/security-researcher-creates-new-backdoor-inspired-by-leaked-nsa-malware\/"},"author":{"name":"TH Author","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476"},"headline":"Security researcher creates new backdoor inspired by leaked NSA malware","datePublished":"2019-04-24T23:23:01+00:00","mainEntityOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/security-researcher-creates-new-backdoor-inspired-by-leaked-nsa-malware\/"},"wordCount":618,"publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/security-researcher-creates-new-backdoor-inspired-by-leaked-nsa-malware\/#primaryimage"},"thumbnailUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2019\/04\/security-researcher-creates-new-backdoor-inspired-by-leaked-nsa-malware.jpg","articleSection":["ZDNet | Security"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.threatshub.org\/blog\/security-researcher-creates-new-backdoor-inspired-by-leaked-nsa-malware\/","url":"https:\/\/www.threatshub.org\/blog\/security-researcher-creates-new-backdoor-inspired-by-leaked-nsa-malware\/","name":"Security researcher creates new backdoor inspired by leaked NSA malware 2026 | ThreatsHub Cybersecurity News","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/security-researcher-creates-new-backdoor-inspired-by-leaked-nsa-malware\/#primaryimage"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/security-researcher-creates-new-backdoor-inspired-by-leaked-nsa-malware\/#primaryimage"},"thumbnailUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2019\/04\/security-researcher-creates-new-backdoor-inspired-by-leaked-nsa-malware.jpg","datePublished":"2019-04-24T23:23:01+00:00","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","breadcrumb":{"@id":"https:\/\/www.threatshub.org\/blog\/security-researcher-creates-new-backdoor-inspired-by-leaked-nsa-malware\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.threatshub.org\/blog\/security-researcher-creates-new-backdoor-inspired-by-leaked-nsa-malware\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/security-researcher-creates-new-backdoor-inspired-by-leaked-nsa-malware\/#primaryimage","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2019\/04\/security-researcher-creates-new-backdoor-inspired-by-leaked-nsa-malware.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2019\/04\/security-researcher-creates-new-backdoor-inspired-by-leaked-nsa-malware.jpg","width":1000,"height":425},{"@type":"BreadcrumbList","@id":"https:\/\/www.threatshub.org\/blog\/security-researcher-creates-new-backdoor-inspired-by-leaked-nsa-malware\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.threatshub.org\/blog\/"},{"@type":"ListItem","position":2,"name":"Security researcher creates new backdoor inspired by leaked NSA malware"}]},{"@type":"WebSite","@id":"https:\/\/www.threatshub.org\/blog\/#website","url":"https:\/\/www.threatshub.org\/blog\/","name":"ThreatsHub Cybersecurity News","description":"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform","publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"alternateName":"Threatshub.org","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.threatshub.org\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.threatshub.org\/blog\/#organization","name":"ThreatsHub.org","alternateName":"Threatshub.org","url":"https:\/\/www.threatshub.org\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","width":432,"height":435,"caption":"ThreatsHub.org"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/threatshub"]},{"@type":"Person","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476","name":"TH Author","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","caption":"TH Author"}}]}},"_links":{"self":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/26965","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/comments?post=26965"}],"version-history":[{"count":0,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/26965\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media\/26966"}],"wp:attachment":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media?parent=26965"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/categories?post=26965"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/tags?post=26965"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}