New Windows Backdoor Hides Inside ESET Agent and Wakes Up With a Secret Network Packet

SLEEPWALKER is a Windows backdoor built to stay quiet until an operator sends a specially crafted network packet. Rather than calling home to a fixed command server, it hides inside a trusted management process and waits, creating little network activity for defenders to spot.

The malware uses DLL side-loading, which makes a legitimate program load a malicious supporting file placed beside it.

It has appeared in recent Windows sideloading attacks, but SLEEPWALKER adds a passive trigger and a custom language for later commands. Analysts at R136a1 identified the malware after examining an unremarkable sample.

R136a1 said in a report shared with Cyber Security News (CSN) that the code cannot yet be linked to a known threat group or a confirmed victim.

The evidence points to a targeted intrusion rather than a broad spam campaign. It must be placed beside the management agent and usually needs an attacker able to reach the victim network, but it can then receive tasks, move data, and run code in memory.

New Windows Backdoor

SLEEPWALKER is a 64-bit Windows library masquerading as a component of the ESET Management Agent. When the agent process starts, the malicious library checks only the host process name.

If it does, it starts a worker, decrypts its startup instruction, and begins watching network traffic. The built-in instruction tells the implant to monitor every available network interface indefinitely.

It does not open a visible listening port or send an initial beacon, unlike the activity described in this Mistic in-memory backdoor report. The genuine management software can continue ordinary activity. This complicates early incident response.

The trigger is checked against several conditions, including packet length, checksums, and encryption. A failed check produces no reply.

A valid packet is decrypted and passed to a compact interpreter, with 23 instructions for scheduling, staging, communications, and memory-only execution.

This limits detections based on suspicious domains or unusual outbound connections. A clean traffic record does not rule out a compromise because the implant can wait silently for a command. The report found no hard-coded command server, domain, or URL in the examined sample.

Hidden Commands and Risk

Once activated, the backdoor can receive follow-up tasks through TCP, UDP, ICMP, SMB named pipes, raw packets, or VMware’s VMCI channel.

VMCI passes communications between virtual machines and a host without traversing a physical network adapter. Similar efforts to blend remote control into trusted software appeared in the C2Looper update mechanism.

The malware also contains a DNS-based trigger capability, although it was not enabled in the analyzed startup configuration.

If used in another build or a later task, specially formatted DNS queries could carry encrypted instructions through networks that allow DNS while restricting other traffic. This makes unusual DNS patterns worth reviewing.

Its post-trigger options raise the risk further. SLEEPWALKER can stage memory-resident code, verify it with a cryptographic hash, and run it without placing a ready-made payload on disk.

It can create named pipes and use supplied credentials to communicate with other systems, opening a possible path for lateral movement.

The implant weakens local protections to make anonymous named-pipe access easier. It changes Windows settings and attempts to reverse them later, although the report warns cleanup may remove a setting that existed before the malware ran.

These changes require administrator rights, so the sample does not show a way to gain elevated access itself.

Organizations should investigate library loading from management-agent folders, validate file signatures and hashes, and compare anonymous SMB and named-pipe settings with approved baselines.

Teams should also monitor raw-packet capture, interface monitoring, and suspicious process-side library loads, lessons reinforced by the HoneyMyte sideloading backdoor case.

R136a1 released a detection rule and a read-only PowerShell scanner that checks known file and configuration artifacts.

Since the analysis covers one binary without incident telemetry, the delivery method, infrastructure, victims, and attacker remain unknown. Still, its quiet activation model makes rapid hunting and containment prudent when the listed indicators appear.

Indicators of compromise (IoCs):-

Type	Indicator	Description
SHA-256	d347170752a28e2b8c4b8b9f3cab2e3a6541ba11682c94498d26eb9002779d60	SHA-256 hash of the analyzed SLEEPWALKER sample
File placement	dpapi.dll beside ERAAgent.exe	Unexpected DLL placement associated with the side-loading chain
File name	dpapisvc.dll	Unexpected companion DLL name referenced by the malware
Registry value	EveryoneIncludesAnonymous = 1	Setting changed to make permissions granted to Everyone apply to anonymous access tokens
Registry value	Unexpected entry in NullSessionPipes	May permit unauthenticated access to a named pipe; compare with a known-good baseline

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC