A newly uncovered backdoor for Windows, dubbed SLEEPWALKER, remains dormant until it’s activated by a specially crafted network packet. Once triggered, it runs commands written in its own 23-instruction language.
The sample in question is a 64-bit unsigned DLL, just under 60KB, designed to be side-loaded into ESET Management Agent’s executable, ERAAgent.exe. It masquerades as Microsoft’s dpapi.dll, exporting the same seven data protection functions as the real library, and even uses versioning resources from ESET’s agent to hide in plain sight. There are no embedded domains, IP addresses, or URLs, and the backdoor makes no outbound connections on its own. That means typical tools that detect malicious network traffic go blind to this implant.
How It Awakens & Operates
The backdoor carries an embedded configuration which, once decrypted via AES-256-CCM, includes instructions to monitor all network interfaces indefinitely for a trigger packet. It captures all traffic across those interfaces—including data intended for other hosts—so even a gateway or VPN server could inadvertently be the listener. Once the correct packet is detected, the implant starts executing its own bytecode, though only one of its two built-in mechanisms for trigger detection is active in this build (the other, based on DNS, is present but disabled).
The custom bytecode framework supports six different transport types—TCP, UDP, ICMP, SMB named pipes, raw promiscuous captures, and VMware’s VMCI (Virtual Machine Communication Interface). These facilities allow the malware to move and schedule data, deliver files in stages (with SHA-256 verification), and run code directly in memory. Notably, none of its instructions write to disk, meaning it depends on other components or preexisting files on the compromised machine for stored payloads.
Deployment, Persistence & Detection Challenges
SLEEPWALKER is clearly a post-compromise implant. Attackers would need local admin rights already to place the malicious DLL next to ERAAgent.exe. The backdoor persists only through Windows DLL search-order side-loading—there’s nothing to patch in ESET software because it operates via legitimate system behaviors rather than exploiting a specific flaw.
The typical detection footprint is minimal. Alongside the DLL itself, a few host-level indicators include: unexpected dpapi-named DLLs (such as dpapi.dll or dpapisvc.dll) in the ESET agent directory; SHA-256 and MD5 hashes of the malicious file; specific registry changes like setting EveryoneIncludesAnonymous to true and adding entries to NullSessionPipes. Detection tools are scarce, and existing YARA rules rely on a static AES key, leaving the backdoor sensitive to even small changes in compilation settings.
The researcher responsible for uncovering SLEEPWALKER was unable to link the sample to a known hacker group, industry sector, or nation. There’s also no confirmed evidence yet of it being deployed in the wild, nor victims publicly identified. No response or advisory had been issued by ESET by August 26, 2026.
Analysts warn this backdoor is consistent with a well-resourced, highly targeted surveillance operation—not an opportunistic attack campaign. Its ability to stay silent until triggered, evade network-based detection, and load via side-loading makes it a dangerous tool in the adversary’s arsenal.
What this means: Threat actors are increasingly relying on implants that don’t reach out to known infrastructure, hide inside legitimate software, exploit trusted paths (like DLL loading), and activate only when needed. Tracking static indicators won’t be enough—behavioral detection, zero-trust restrictions on process permissions, tight control over elevation, and prompt incident response will all be vital in defending against threats like SLEEPWALKER.
