You don't want this Sleepwalker backdoor on your Windows machine
- ID
- 17505
- Status
- summarized
- Published
- 25 Aug 2026, 5:39 AM
- Fetched
- 25 Aug 2026, 10:21 AM
- Provider
- The Register
- Category
- technology
- Original URL
- https://www.theregister.com/security/2026/08/24/you-dont-want-this-sleepwalker-backdoor-on-your-windows-machine/5292021
- Source URL
- https://www.theregister.com/headlines.atom
Summary
- Score
- 2.5
- Created
- 25 Aug 2026, 10:22 AM
- Tags
- Audience
- developers
What happened
Malware researcher Dominik Reichel disclosed a Windows backdoor called Sleepwalker that hides in memory inside a 64-bit DLL impersonating Microsoft's dpapi.dll, side-loads via ESET Management Agent (ERAAgent.exe), and stays dormant until a specifically crafted network packet activates it. It uses a custom 23-instruction command language and can communicate over VMware VMCI targets, suggesting a well-resourced, targeted operation rather than opportunistic malware.
Why it matters
If your Windows fleet runs ESET Management Agent, check for a rogue dpapisvc.dll alongside the legitimate dpapi.dll — that's the side-loading tell. For most builders not running ESET ERAAgent on Windows, this is notable threat intelligence but not something requiring immediate action.
Discussion angle
The DLL side-loading technique (forging a legitimate Microsoft filename and exporting identical functions) is a pattern worth understanding for anyone building Windows software — how does your own toolchain avoid being a side-loading vector?