Newly SLEEPWALKER Backdoor Waits for One Crafted Packet, Then Runs Its Own Bytecode

Summary

A new Windows backdoor named SLEEPWALKER has been discovered that remains dormant in memory until it receives a specifically crafted network packet. Once triggered, it executes commands written in a custom 23-instruction language. The malware is designed to be side-loaded into ESET Management Agent and impersonates a legitimate DLL, making it difficult to detect through traditional network monitoring.

Full text

Newly SLEEPWALKER Backdoor Waits for One Crafted Packet, Then Runs Its Own Bytecode Swati KhandelwalAug 26, 2026Malware / Threat Detection An independent malware researcher has documented a previously unreported Windows backdoor, dubbed SLEEPWALKER, that stays inert in memory until a specifically crafted network packet reaches the machine and then runs commands written in a 23-instruction language of its own design. The sample is an unsigned 64-bit Windows dynamic-link library (DLL) of 59,904 bytes, built to be side-loaded into ERAAgent.exe, the Windows executable for ESET Management Agent. It impersonates Microsoft's dpapi.dll, exporting the same seven data protection functions as the genuine system library, and carries a version resource copied from ESET Management Agent. There are no domains, IP addresses or URLs built into the file, and it makes no outbound connection of its own, so an infected host can look clean to tooling that watches for connections to known-bad infrastructure. Commands arrive as bytecode rather than readable text, so recovering the encryption key yields opcodes in a format that exists nowhere but inside this one file. Dominik Reichel, a former Palo Alto Networks Unit 42 malware researcher, said the approach is "consistent with a targeted, well-resourced operation rather than an opportunistic one." The assessment rests on a single binary supplied with no collection context, and Reichel could not attribute the sample to any known actor, establish a victim, an industry, or a country, or determine whether the sample was ever deployed. Its embedded configuration decrypts using AES-256-CCM into a single instruction that tells the backdoor to monitor every network interface indefinitely for that packet. The listener captures everything crossing each watched interface, including traffic addressed to other machines. A gateway, VPN server or host bridging two network segments could therefore see a trigger meant for a different machine entirely. SLEEPWALKER checks only the host process name, not its signature or path. Writing the file into that directory requires local administrator rights that an operator must already hold, and the backdoor relies on the security context of its host process rather than obtaining those rights itself. The backdoor is therefore a post-compromise implant rather than an entry point, and how an operator first reached the machine and wrote the DLL into that directory remains unknown. Side-loading is also its only persistence mechanism, and the DLL loads again each time the ESET Management Agent service starts. The side-loading relies on Windows DLL search order rather than a flaw in ESET's software, so there is nothing to patch, and the response to a confirmed match is incident response and a rebuild. ESET's products have been abused for side-loading before, including by ToddyCat, which Kaspersky said exploited a search-order flaw in the company's command-line scanner to load a malicious DLL into ESET. The Hacker News has reached out to ESET for comment on whether it has telemetry on the sample and will update this story with any response. ESET has issued no advisory or public statement on the malware as of August 26. The 23 instructions cover scheduling, several ways to move data, staged file delivery verified against a SHA-256 hash before it runs, and executing code directly in memory. They ride on six transports, comprising TCP, UDP, ICMP, SMB named pipes with credentialed lateral movement, raw promiscuous capture, and VMware's Virtual Machine Communication Interface (VMCI). VMCI traffic passes through the virtualization layer rather than a network adapter, so a packet capture taken between two machines misses it entirely. UNC3886 used VMCI sockets for persistence between compromised ESXi hosts and their guest virtual machines in intrusions documented by Mandiant. No instruction in the language writes to disk, so anything the backdoor expects to find on a compromised machine has to be placed there by another component. Two of the instructions watch for the trigger. The opcode stored in the analyzed sample enables only the raw-packet listener. At the same time, a second opcode also enables a DNS-based trigger implemented in the binary but not active in this build. To let unauthenticated callers reach its named-pipe channel, SLEEPWALKER sets the EveryoneIncludesAnonymous registry value and adds its pipe name to NullSessionPipes. Its cleanup routine records whether its own write to NullSessionPipes succeeded rather than whether an entry was already present, so a removal can delete a legitimate entry that predates the infection. Reichel published the following host indicators - An unexpected dpapi.dll beside ERAAgent.exe An unexpected dpapisvc.dll in the same directory SHA-256: d347170752a28e2b8c4b8b9f3cab2e3a6541ba11682c94498d26eb9002779d60 MD5: 2318327b29bb1c0e2d2b5f0211fc7fac EveryoneIncludesAnonymous set to 1 An unexpected entry in NullSessionPipes The two registry values carry weight only against a known-good baseline. The writeup ships a YARA rule and a read-only PowerShell scanner that checks those indicators across an estate. Reichel said detection coverage for the file was low at publication, without stating a basis for that assessment. He noted that the YARA rule keys partly on a static AES key and on compiled protocol code, which a rebuild with different compiler settings could break. The Hacker News found no public release of the analysis toolkit or the mitigation guide described in the post on Reichel's site or his GitHub profile as of August 26. Reichel said anyone who believes they have been targeted should contact him directly. Magic-packet implants of this kind have surfaced on Linux systems, including Red Menshen's use of passive backdoors like BPFDoor inside telecom operator networks, as documented by Rapid7. Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. SHARE     Tweet Share Share Share SHARE  Backdoor, endpoint security, Malware, malware analysis, network security, reverse engineering, Threat Detection, Windows Security ⚡ Top Stories This Week Microsoft Patches Severe Entra ID Flaw (CVSS 10.0) Allowing Remote Code Execution ThreatsDay: Gogs 10.0 RCE, n8n Workflow-to-RCE, $10M Reward, GLM-5.3 AI Exploit, and More New Cryptographic Context Injection Attack Could Let Web Pages Steal Grok Chat Data Zombie Card Attack Can Revive Expired Visa Cards for Contactless Payments CDN Tsunami Attack Abuses HTTP/3 Translation for Up to 350x DoS Amplification Manic Android Malware Exfiltrates Data From Offline Phones via Nearby Infected Devices Cloudflare Workers Spectre Attack Leaks JWT From Co-Located Worker at 12 Bits/Second OpenAI Pauses Frontier RL Training as It Tightens Defenses Against Unsafe AI Behavior Hackers Compromised 14,500+ Dahua Devices Using Credential Attacks, Auth Bypasses, and P2P Microsoft Copilot Personal Flaws Could Let One Click Exfiltrate Data From Connected Apps AI "Mind Viruses" Can Spread Between Agents Through Persistent Prompt Files SafePal Hardware Wallet Maker Says Flaw Exposed Data of Nearly 40,000 Customers Critical GitLab GraphQL Flaw Could Let Unauthenticated Attackers Delete Public Projects ⚡ Weekly Recap: VMware Exploits, Windows 0-Day, MCP Attacks, Browser Hijacks and More Unisoc VoLTE Video Call Exploit Chain Can Give Attackers Full Android Kernel Access Evooo1Bot Linux Botnet Exploits Known Flaws to Turn Edge Devices Into SOCKS5 Proxies SAP Commerce Cloud CVE-2026-58231 Targeted in Exploitation Attempts Days After Patch Hackers Spend Nearly $7 Million on Expired Domains to Redirect Traffic to Scams and Malware Apple Warns Users in 110 Countries They May Be Targets of Mercenary Spyware Trump Memo Paves Way for U.S. Firms to Hack and Disrupt Foreign Crime Groups GeoServer Zero-Day Targeted in Active Exploitation Attempts, Can Lead to RCE Attackers Exploit SharePoint Authentication

Indicators of Compromise

• malware — SLEEPWALKER
• mitre_attack — T1074
• mitre_attack — T1059
• mitre_attack — T1105

Entities