Researchers have uncovered a previously unknown Windows backdoor named SLEEPWALKER that can receive attacker commands through covert channels including raw network packets, DNS queries, SMB named pipes, ICMP ping traffic, and VMware’s VMCI communication layer.
The malware is designed to remain dormant and avoid the usual signs of compromise. It does not contact a hard-coded command-and-control server, open a default listening port, or include an embedded final-stage payload.
Instead, it waits for a specially crafted and encrypted trigger packet before activating. SLEEPWALKER was found as an unsigned 64-bit DLL impersonating Microsoft’s dpapi.dll.
The sample copies version information from ESET Management Agent and is built to be side-loaded by ERAAgent.exe, the ESET Management Agent executable. It checks the host process name and remains inactive unless it runs inside that process.
SLEEPWALKER Covert Comms
Once activated, SLEEPWALKER decrypts and executes attacker-supplied bytecode through a custom command interpreter.
The malware supports 23 instructions for scheduling tasks, transferring data, receiving follow-up programs, assembling staged payloads, decompressing code, and running shellcode directly in memory.
Its built-in configuration contains only one function: continuously monitor network interfaces for a hidden trigger. The backdoor uses promiscuous-mode packet capture to inspect traffic before normal protocol processing.
A packet must pass several validation checks, including framing checks, CRC-32 validation, and AES-256-CCM authentication, before SLEEPWALKER accepts it as a command.
This passive design makes network-based detection harder. A compromised host may continue to show normal ESET Management Agent activity while the implant itself produces no beaconing or suspicious outbound traffic.
The first visible sign may be the attacker’s trigger packet. SLEEPWALKER can send data using TCP, UDP, ICMP echo requests, and Windows SMB named pipes.
ICMP support allows operators to conceal data in ping payloads, while SMB named pipes can support communication with other Windows systems on a local network. The malware can optionally authenticate to remote systems with supplied credentials.
The backdoor also supports VMware VMCI, a virtualization communication mechanism used between a guest virtual machine and its host, or between guests on the same VMware host.
VMCI traffic does not traverse a physical network adapter, limiting visibility for traditional packet-capture tools. A DNS-based trigger mechanism is also present. It can extract encrypted commands from specially formatted DNS query labels.
However, the analyzed sample’s embedded bootstrap configuration enables only the raw-packet listener; DNS triggering would require a different build or a later command that activates the DNS-aware listener.
SLEEPWALKER can additionally weaken host security to enable anonymous named-pipe access.
It modifies Windows settings related to anonymous SMB sessions and creates named pipes accessible to Everyone and Anonymous Logon.
These actions require administrator-level privileges already held by the compromised process, r136a1 said. Researchers have not linked SLEEPWALKER to a known threat actor, campaign, victim, or industry.
The sample shows capabilities rather than confirmed attacker activity, meaning the presence of VMCI, DNS, ICMP, and SMB functions does not prove every channel was used in an intrusion.
Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN-> Power your SOC with ANY.RUN
