New SLEEPWALKER Backdoor Waits for One Crafted Packet, Then Runs Its Own Bytecode
- ID
- 18050
- Status
- summarized
- Published
- 26 Aug 2026, 3:12 PM
- Fetched
- 26 Aug 2026, 9:35 PM
- Provider
- The Hacker News
- Category
- security
- Original URL
- https://thehackernews.com/2026/08/newly-sleepwalker-backdoor-waits-for.html
- Source URL
- https://feeds.feedburner.com/TheHackersNews
Summary
- Score
- 3.0
- Created
- 26 Aug 2026, 9:38 PM
- Tags
- Audience
- developers
What happened
An independent malware researcher documented SLEEPWALKER, a 59,904-byte unsigned Windows DLL that side-loads into ESET Management Agent's ERAAgent.exe by impersonating Microsoft's dpapi.dll. It stays dormant in memory until a specifically crafted network packet arrives, then executes commands in a custom 23-instruction bytecode language, with no embedded C2 infrastructure or outbound connections. The single sample has no known victims, attribution, or deployment evidence, and a former Unit 42 researcher assessed it as consistent with a targeted, well-resourced operation.
Why it matters
This is a post-compromise implant requiring local admin rights, not an entry-point exploit, so it is not directly actionable for most builders. The only practical takeaway is for teams running ESET Management Agent on Windows: verify the integrity of dpapi.dll in that agent's directory and monitor for unsigned DLLs side-loading into ERAAgent.exe.
Discussion angle
The design choices that make SLEEPWALKER hard to detect — no embedded infrastructure, custom bytecode, promiscuous-mode packet sniffing — are worth discussing as a pattern for how sophisticated implants evade standard EDR and network monitoring, even if this specific sample has no known victims.