← Latest briefing

Technology

Newly discovered Windows backdoor 'Sleepwalker' evades detection by awaiting network magic packets

A newly identified malware uses a custom 23-instruction command language and stays silent in memory until activated by specific network traffic.

The short version

  • Malware researcher Dominik Reichel detailed 'Sleepwalker,' a passive Windows backdoor that stays silent in system memory without generating outbound traffic or opening listening ports.
  • The malware side-loads into the ESET Management Agent executable by impersonating a Microsoft dynamic link library (DLL) file.
  • Once activated by a specific 'magic packet,' the backdoor executes commands using a custom 23-instruction language to run code or exfiltrate data.
  • The identity of the threat actor behind the backdoor remains unknown, though its design suggests a targeted, well-resourced campaign.

Key facts

  • Security researcher Dominik Reichel published a technical analysis disclosing a previously unseen Windows backdoor named Sleepwalker.[Slashdot]
  • Sleepwalker remains passive in memory and relies on inspecting network traffic for a specific 'magic packet' rather than initiating outbound command-and-control connections.[Slashdot]
  • The backdoor uses a bespoke 23-instruction command language designed to handle scheduling, deliver files, move data, and run code directly in memory.[Slashdot]
  • The malware is disguised as a 64-bit Windows DLL file impersonating Microsoft's dpapi.dll and side-loads into ESET's ERAAgent.exe binary.[Slashdot]
  • Sleepwalker can use a VMware VMCI target as a remote host instead of standard network addresses.[Slashdot]

What remains uncertain

  • The specific threat group or organization responsible for deploying Sleepwalker has not been identified.[Slashdot]
  • The total number of infected systems and targets of the operation are currently unknown.[Slashdot]

Sources