SLEEPWALKER Backdoor Stays Dormant Until Triggered by Single Custom Network Packet

SLEEPWALKER is a backdoor for Windows designed to remain inactive until it receives a single custom encrypted network packet. When triggered, the implant decrypts and executes its own bytecode, reducing network artifacts and complicating detection.

The backdoor follows an unusual approach on Windows: it does not call home, maintain a persistent channel, or generate typical beaconing traffic that often reveals malware families. It stays silent and resident in memory, activating only when it receives one specially crafted network packet. This trigger is sufficient to launch the implant and execute actions without requiring the infected system to initiate any prior communication.

The core of the design lies in how it interprets commands. Instead of text commands or easily inspectable structures, the packet carries a small program in bytecode belonging to a proprietary language with 23 instructions. This mini-language allows chaining tasks, moving information, receiving additional stages, and executing code in memory. The goal is to minimize network indicators until the last moment and shift logic into a format less evident to traditional inspection tools.

The camouflage also targets discretion. The analyzed sample presents itself as a 64-bit DLL that impersonates dpapi.dll and exports the same seven functions expected from the name, while falsifying version metadata to appear legitimate, including an appearance linked to ESET. The implant seeks to load via DLL side-loading inside ERAAgent.exe, the executable of the ESET Management Agent used in ESET PROTECT and ESET PROTECT On-Prem deployments. To strengthen control, it only wakes if the host process matches the expected one.

Internal configuration is protected with AES-256-CCM and, in the described case, reduces to a bootstrap instruction that orders indefinite monitoring of network interfaces. From there, it can inspect traffic in promiscuous mode and evaluate packets at raw content level, allowing the trigger to be hidden inside IP traffic that might appear routine at first glance. An alternative channel for transporting triggers via DNS queries exists but was not activated in the sample.

The backdoor supports multiple transports for communication and task delivery, including TCP, UDP, ICMP, SMB named pipes, and a VMware VMCI channel between guest and host. A delicate nuance appears in this repertoire: to facilitate unauthenticated access to named pipes, the malware can modify Windows registry values such as EveryoneIncludesAnonymous and NullSessionPipes, lowering the system's security posture. These changes require local administrator permissions, and the analyzed code does not itself confirm a privilege escalation path.

No confirmed victims, sectors, countries, or attributed infrastructure have been identified, and public analysis stems from a single sample without associated incident telemetry. Nevertheless, the approach aligns with targeted operations by reducing network footprint, avoiding reliance on a fixed C2, and waiting for the opportune moment to activate.

For security teams, immediate measures include auditing endpoints with ESET Management Agent and checking for an unexpected dpapi.dll in the same directory as ERAAgent.exe. It is also advisable to search for the presence of dpapisvc.dll next to the executable, a name that does not correspond to a standard Windows component. Researchers have published YARA rules and read-only scanning utilities to confirm matches by hash and characteristic artifacts.