New SLEEPWALKER Backdoor Waits for One Crafted Packet, Then Runs Its Own Bytecode
A new Windows backdoor dubbed SLEEPWALKER hides as ESET Management Agent's dpapi.dll, waits for a crafted network packet, then executes custom 23-instruction bytecode.
Researcher Dominik Reichel documented SLEEPWALKER, an unsigned 59,904-byte 64-bit Windows DLL that side-loads into ESET Management Agent's ERAAgent.exe while impersonating dpapi.dll. The implant monitors every network interface indefinitely for a specifically crafted trigger packet, then executes commands written in a custom 23-instruction bytecode language over six transports, including TCP, UDP, ICMP, SMB named pipes, raw promiscuous capture, and VMware VMCI. It has no embedded infrastructure, makes no outbound connections of its own, and requires prior local administrator access to install; no victims, attribution, or in-the-wild deployment are confirmed. Reichel assesses the design as consistent with a targeted, well-resourced operation, while ESET calls the scenario's security relevance negligible since it provides no new access path.