New SLEEPWALKER Backdoor Waits for One Crafted Packet, Then Runs Its Own Bytecode
SLEEPWALKER is a previously unreported Windows backdoor that remains dormant in memory until triggered by a specifically crafted network packet, then executes commands via a custom 23-instruction bytecode language The malware is an unsigned 64-bit DLL (59,904 bytes) side-loaded into ESET Management Agent (ERAAgent.exe), impersonating Microsoft's dpapi.dll while exporting identical functions to appear legitimate It supports six communication transports (TCP, UDP, ICMP, SMB named pipes, raw promis
65
Hot
70
Quality
55
Impact
Analysis
TL;DR
- SLEEPWALKER is a previously unreported Windows backdoor that remains dormant in memory until triggered by a specifically crafted network packet, then executes commands via a custom 23-instruction bytecode language
- The malware is an unsigned 64-bit DLL (59,904 bytes) side-loaded into ESET Management Agent (ERAAgent.exe), impersonating Microsoft's dpapi.dll while exporting identical functions to appear legitimate
- It supports six communication transports (TCP, UDP, ICMP, SMB named pipes, raw promiscuous capture, and VMware VMCI), uses AES-256-CCM encryption, and performs staged file delivery with SHA-256 verification before execution
- The implant is purely post-compromise with no outbound connections of its own, no hardcoded infrastructure, and no disk-write instructions—making it extremely difficult to detect through traditional network monitoring
- Analysis was conducted by independent researcher Dominik Reichel (formerly Palo Alto Networks Unit 42), who assessed the sophistication as consistent with a targeted, well-resourced operation, though attribution remains unknown
Why It Matters
SLEEPWALKER represents a significant evolution in stealthy backdoor design, combining passive network listening, custom bytecode execution, and DLL side-loading to evade detection—a pattern increasingly relevant as threat actors prioritize persistence over broad compromise. For AI and security practitioners, it highlights the growing importance of behavioral and host-based detection over signature-based approaches, especially as malware increasingly leverages legitimate software ecosystems and virtualization layers for covert communication.
Technical Details
- Architecture & Delivery: The backdoor is a 59,904-byte unsigned 64-bit DLL designed for side-loading into ERAAgent.exe (ESET Management Agent). It impersonates Microsoft's dpapi.dll by exporting the same seven data protection functions and carries a version resource copied from the legitimate ESET executable. Side-loading exploits Windows DLL search order, not a software vulnerability.
- Custom Bytecode Language: Commands are delivered as encrypted bytecode in a proprietary 23-instruction language covering scheduling, data movement, staged file delivery (SHA-256 verified before execution), and in-memory code execution. No instruction writes to disk, meaning all persistent artifacts must be placed by a separate component.
- Trigger Mechanism: The implant decrypts its configuration using AES-256-CCM into an instruction that monitors all network interfaces indefinitely for a crafted trigger packet. It captures all traffic crossing watched interfaces (including traffic for other machines), meaning gateways, VPN servers, or bridging hosts could be activated by packets destined elsewhere. A secondary DNS-based trigger exists in the binary but was inactive in the analyzed sample.
- Persistence & Lateral Movement: Persistence relies solely on DLL side-loading, reloading each time the ESET Management Agent service starts. For lateral movement, it opens SMB named pipes to unauthenticated callers by setting the
EveryoneIncludesAnonymousregistry value to 1 and adding its pipe name toNullSessionPipes—a cleanup routine that risks deleting pre-existing legitimate entries. - Transport Layer Diversity: Six transports are supported: TCP, UDP, ICMP, SMB named pipes with credentialed lateral movement, raw promiscuous packet capture, and VMware's Virtual Machine Communication Interface (VMCI). VMCI traffic bypasses network adapters entirely, passing through the virtualization layer and evading standard packet captures—a technique previously observed in UNC3886 intrusions.
- Detection Indicators: Host indicators include an unexpected
dpapi.dllordpapisvc.dllbesideERAAgent.exe, registry modifications (EveryoneIncludesAnonymous=1, anomalousNullSessionPipesentries), and file hashes (SHA-256:d347170752a28e2b8c4b8b9f3cab2e3a6541ba11682c94498d26eb9002779d60; MD5:2318327b29bb1c0e2d2b5f0211fc7fac). A YARA rule was published but may break if compiler settings change. Detection coverage was reported as low at publication.
Industry Insight
- Shift Toward Passive Implants: The SLEEPWALKER design—waiting passively for a trigger rather than maintaining active C2 channels—reflects a broader industry trend toward low-noise, long-lived implants that minimize detection surface. Security teams should prioritize host-level monitoring and baseline anomaly detection over perimeter-based threat intelligence alone.
- Supply Chain & Legitimate Software Abuse: The exploitation of ESET Management Agent via DLL side-loading underscores the risk posed by legitimate enterprise software becoming a delivery vector. Organizations should enforce strict DLL search-order hardening (e.g.,
DLL_SEARCH_ORDER_DISABLE_LEGACY,DEFAULT_SECURE_PROCESS_PATH) and audit side-loading configurations across all managed endpoints. - Virtualization as a Covert Channel: The use of VMware VMCI for command-and-control traffic demonstrates how virtualization layers can be weaponized to bypass network monitoring. Cloud and virtualized environments require specialized visibility into hypervisor-level traffic, and incident response playbooks should account for VMCI-based persistence when investigating ESXi or vSphere compromises.
Disclaimer: The above content is generated by AI and is for reference only.
Security Research