Technology
Newly discovered Windows backdoor 'Sleepwalker' evades detection by awaiting network magic packets
A newly identified malware uses a custom 23-instruction command language and stays silent in memory until activated by specific network traffic.
The short version
- Malware researcher Dominik Reichel detailed 'Sleepwalker,' a passive Windows backdoor that stays silent in system memory without generating outbound traffic or opening listening ports.
- The malware side-loads into the ESET Management Agent executable by impersonating a Microsoft dynamic link library (DLL) file.
- Once activated by a specific 'magic packet,' the backdoor executes commands using a custom 23-instruction language to run code or exfiltrate data.
- The identity of the threat actor behind the backdoor remains unknown, though its design suggests a targeted, well-resourced campaign.
Key facts
- Security researcher Dominik Reichel published a technical analysis disclosing a previously unseen Windows backdoor named Sleepwalker.[Slashdot]
- Sleepwalker remains passive in memory and relies on inspecting network traffic for a specific 'magic packet' rather than initiating outbound command-and-control connections.[Slashdot]
- The backdoor uses a bespoke 23-instruction command language designed to handle scheduling, deliver files, move data, and run code directly in memory.[Slashdot]
- The malware is disguised as a 64-bit Windows DLL file impersonating Microsoft's dpapi.dll and side-loads into ESET's ERAAgent.exe binary.[Slashdot]
- Sleepwalker can use a VMware VMCI target as a remote host instead of standard network addresses.[Slashdot]