A newly documented Windows backdoor called Sleepwalker does nothing until a single crafted packet wakes it, then executes commands written in its own 23-instruction language.
Malware researcher Dominik Reichel detailed the passive backdoor on Monday. It hides inside a 64-bit DLL that impersonates Microsoft’s dpapi.dll, exports the same seven functions, and loads through DLL side-loading into ERAAgent.exe, the Windows executable for ESET Management Agent. A forged ESET version resource adds cover. After confirming its host process name, the malware sleeps in memory, which keeps it hidden from traditional antivirus scans.
Instead of calling home to a command-and-control server, Sleepwalker sniffs every packet crossing the network for a magic pattern. When one matches, it decrypts the payload with AES-256-CCM and runs it. The commands cover scheduling, multiple ways to move data, staged file delivery, and running code directly in memory. Remote targets can even be VMware VMCI addresses rather than normal network endpoints.
Reichel calls the whole package consistent with a targeted, well-resourced operation rather than an opportunistic one.
Defenders should note that the backdoor never sends traffic on its own and opens no obvious listening port by default, so clean outbound logs do not rule out an infection. Detection depends on memory inspection and monitoring for ERAAgent.exe side-loading anomalies.
