SLEEPWALKER Backdoor Activates on Windows via Single Custom Encrypted Packet
SLEEPWALKER is a backdoor for Windows designed to remain inactive until it receives a single custom encrypted network packet. When the packet arrives, the implant decrypts and executes its own bytecode, reducing network footprint and complicating detection.
The backdoor follows an unusual approach on Windows: it does not call home, does not maintain a persistent channel, and avoids the typical beaconing that often reveals malware families. It stays silent, resident in memory, and only activates when it receives one specially crafted network packet. That trigger is enough to start the implant and execute actions without any prior communication from the infected system.
The core of the design lies in how it interprets commands. Instead of text commands or easily inspectable structures, the packet carries a small program in bytecode belonging to a proprietary language with 23 instructions. This mini language allows chaining tasks, moving data, receiving additional stages, and executing code in memory. The goal is to minimize network indicators until the last moment and move logic into a format less obvious to traditional inspection tools.
The camouflage also focuses on discretion. The analyzed sample presents itself as a 64-bit DLL that impersonates dpapi.dll and exports the same seven functions expected from the name, while also falsifying version metadata to appear legitimate, including an appearance linked to ESET. The implant seeks to load via DLL side-loading inside ERAAgent.exe, the executable of the ESET Management Agent used in ESET PROTECT and ESET PROTECT On-Prem deployments. To strengthen control, it only wakes if the host process matches the expected one.
Internal configuration is protected with AES-256-CCM and, in the described case, reduces to a bootstrap instruction that orders indefinite monitoring of network interfaces. From there it can inspect traffic in promiscuous mode and evaluate packets at raw content level, allowing the trigger to be hidden inside IP traffic that might appear routine. An alternative channel for transporting triggers via DNS queries exists but was not activated in the sample.
The backdoor supports several transports for communication and task delivery, including TCP, UDP, ICMP, SMB named pipes, and a VMware VMCI channel between guest and host. A delicate detail: to facilitate unauthenticated access to named pipes, the malware can modify Windows registry values such as EveryoneIncludesAnonymous and NullSessionPipes, lowering the host's security posture. These changes require local administrator privileges, and the analyzed code does not itself confirm a privilege-escalation path.
No confirmed victims, sectors, countries, or attributed infrastructure have been identified, and the public analysis is based on a single sample without associated incident telemetry. Nevertheless, the approach fits targeted operations: it reduces network footprint, avoids dependence on a fixed C2, and can wait for the right moment to activate.
Immediate defensive measures include auditing endpoints with ESET Management Agent and checking for an unexpected dpapi.dll in the same directory as ERAAgent.exe. Analysts should also look for dpapisvc.dll next to the executable, a name that does not correspond to a standard Windows component. Researchers have published YARA rules and read-only scanning utilities to confirm matches by hash and characteristic artifacts. If activity is suspected, review and correct the values of EveryoneIncludesAnonymous and NullSessionPipes against a baseline. Hardening DLL loading and trimming the side-loading surface with directory integrity controls and policies that limit loads from unexpected paths are also recommended.
Related articles
SLEEPWALKER Backdoor Stays Dormant Until Triggered by Single Custom Network Packet
SLEEPWALKER is a stealthy Windows backdoor that remains inactive until it receives one specially crafted encrypted network packet. The implant then decrypts and executes custom bytecode from a proprietary 23-instruction language, enabling chained tasks, data movement, and in-memory code execution without prior outbound communication. The 64-bit DLL masquerades as dpapi.dll and is designed for DLL side-loading into ERAAgent.exe, the executable of the ESET Management Agent used in ESET PROTECT deployments. It inspects raw network traffic in promiscuous mode, supports multiple transport protocols including TCP, UDP, ICMP, SMB named pipes, and VMware VMCI, and can weaken security by modifying registry values such as EveryoneIncludesAnonymous. No confirmed victims or attribution have been identified, and the analysis is based on a single sample. Researchers recommend auditing endpoints for unexpected dpapi.dll files alongside ERAAgent.exe and reviewing related registry settings.
AmnesiaStealer Malware for macOS Hijacks Authenticated Browser Sessions via ClickFix and Chromium
A new macOS malware strain named AmnesiaStealer has emerged that combines infostealing, persistence mechanisms, and the ability to silently take over already authenticated browser sessions. The infection chain begins with a fake GitHub page that tricks victims into copying a malicious command into Terminal using the ClickFix social engineering technique. Once executed, the Rust-based payload collects system data, displays a fake installer window to capture the user password, and attempts to unlock the Keychain for protected credentials. Targeted data includes browser cookies, history, extensions, documents, Apple Notes, Telegram sessions, and cryptocurrency wallet information. A secondary module copies the browser profile and launches a hidden Chromium instance controlled through the Chrome DevTools Protocol, allowing attackers to interact with active sessions that have already passed multi-factor authentication. Persistence is achieved via a disguised LaunchDaemon, and the malware attempts to remove installation artifacts afterward.
GOFFEE Dissects Custom COW Agent Forked from Poseidon Mythic Implant
Angara Security researchers uncovered a custom Go-based Mythic C2 agent named COW used by the Russian-oriented APT group GOFFEE, also known as Paper Werewolf. The agent represents an independent development branch derived from the public Poseidon project rather than its Freyja fork. Samples were heavily protected with Garble obfuscation and a modified UPX packer that required manual header reconstruction for unpacking. Analysis of surviving strings, build paths, and architectural features confirmed Poseidon origins while revealing numerous custom modifications including Windows support, additional C2 profiles, and new command implementations. The group employs the agent alongside other tools such as PowerTaskel, MiRat, and BindSycler for persistent access to Linux and Windows systems across government, energy, telecom, and defense targets. Researchers traced multiple variants through VirusTotal and incident reports, documenting evolutionary changes in configuration handling and peer-to-peer communication mechanisms.
Manic Android Malware Steals PINs via Transparent Overlay and Relays Data Through Nearby Infected Devices
A newly identified Android malware strain named Manic merges banking trojan, spyware, and remote access capabilities. The threat has been active since at least February 2026 and continues to receive updates that add anti-analysis features, in-memory code loading, and lock-screen credential theft. Manic monitors 169 financial, messaging, and government applications while using a transparent overlay on legitimate numeric keyboards to capture PINs without displaying a full fake banking screen. Stolen data can be forwarded through other compromised nearby devices even when the original phone lacks internet connectivity. Operators also leverage WebRTC sessions for live screen viewing and remote interaction. The malware additionally functions as a keylogger, intercepts SMS and notifications, and collects passwords, one-time codes, and recovery phrases. Security researchers recommend avoiding unknown APKs and scrutinizing requests for Accessibility Services or broad device control permissions.