SLEEPWALKER Backdoor Hides Inside ESET Agent and Awakens Only on Network Trigger

SLEEPWALKER is a newly identified passive Windows backdoor designed to remain dormant until it receives a specially crafted network packet.

Unlike conventional backdoors that regularly contact command-and-control (C2) servers, SLEEPWALKER does not contain fixed C2 domains, IP addresses, URLs, or second-stage payloads.

The malware is designed for DLL side-loading through the ESET Management Agent process, ERAAgent.exe. The analyzed sample is an unsigned 64-bit DLL that masquerades as Microsoft’s dpapi.dll.

It carries version information copied from the legitimate ESET Management Agent, helping it blend into a trusted software environment.

Researcher Dominik Reichel discovered SLEEPWALKER and assessed that its design is more consistent with a targeted and well-resourced operation than opportunistic malware.

However, no specific threat actor, victim, campaign, or intrusion chain has been attributed to the malware.

SLEEPWALKER Backdoor Awakens

Before starting its main functionality, SLEEPWALKER checks whether the host process is named ERAAgent.exe. It then launches a background thread, allocates memory, decrypts its bootstrap instruction, and starts a custom bytecode interpreter.

The embedded configuration contains only a SNIFF_MAGIC_PACKET instruction. This directs the malware to monitor available network interfaces for a matching trigger. The implant can place interfaces into promiscuous mode and inspect packets for the expected structure.

When a valid trigger arrives, SLEEPWALKER uses AES-256-CCM encryption and CRC-32 validation to authenticate and decrypt the task. The decrypted content is not a conventional command but proprietary bytecode.

The malware implements 23 instructions covering sleep and scheduling operations, TCP, UDP, ICMP and named-pipe communications, VMware VMCI communication, staged payload delivery, LZMA decompression, file-based task loading and in-memory shellcode execution.

SLEEPWALKER also supports DNS-based triggering, although the analyzed sample does not enable that capability in its initial configuration.

VMware VMCI support provides another unusual communication option that can operate through the virtualization layer instead of ordinary network traffic.

The backdoor can additionally modify Windows settings to permit unauthenticated named-pipe access. These changes include enabling anonymous access-related settings and creating pipes with permissions for Everyone and Anonymous Logon.

SLEEPWALKER’s passive architecture creates a significant detection challenge. Because it does not autonomously beacon to an attacker-controlled server, defenders cannot depend solely on recurring outbound connections, malicious domains or traditional C2 blocklists.

Security teams should investigate unexpected or unsigned dpapi.dll files located near ERAAgent.exe, especially when accompanied by suspicious named-pipe activity, anonymous SMB configuration changes or unusual network packet inspection behavior.

Indicators of Compromise

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN-> Power your SOC with ANY.RUN