"Consistent with a targeted, well-resourced operation rather than an opportunistic one." That is how independent researcher Dominik Reichel characterizes the design choices behind a previously unreported Windows backdoor he calls SLEEPWALKER.
What the sample is and how it arrives
The analyzed file is an unsigned, 64‑bit Windows DLL of 59,904 bytes built to be side‑loaded into ERAAgent.exe, the executable for ESET Management Agent. It impersonates Microsoft's dpapi.dll by exporting the same seven data‑protection functions and carries a version resource copied from ESET Management Agent.
SLEEPWALKER relies on Windows DLL search order for persistence: when the ESET Management Agent service starts, the malicious DLL will be loaded again. That side‑loading requires an operator with local administrator rights to write the file into the target directory; the backdoor does not escalate privileges itself and instead runs with the host process's security context. Reichel therefore calls it a post‑compromise implant rather than an entry point.
How SLEEPWALKER hides and how it activates
The implant sits inert in memory until it is triggered by a specifically crafted packet. Its embedded configuration decrypts using AES‑256‑CCM into one instruction: monitor every network interface indefinitely for that packet. The listener captures all traffic crossing each watched interface, including traffic addressed to other machines, so gateways, VPN servers or hosts bridging segments could see a trigger intended for a different machine.
There are no domains, IP addresses or URLs embedded in the file, and the binary initiates no outbound connections on its own, which can make an infected host appear clean to tooling that looks for connections to known malicious infrastructure. Commands arrive as bytecode rather than readable text; recovering the encryption key yields opcodes in a format that exists only inside this sample.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadCommand language, transports, and runtime behavior
Reichel extracted a bespoke 23‑instruction language inside the sample. The instruction set covers scheduling, multiple ways to move data, staged file delivery that is verified against a SHA‑256 hash before execution, and direct in‑memory code execution. Notably, no instruction in the language writes to disk; any files the backdoor expects must be placed by another component.
The backdoor implements six transports: TCP, UDP, ICMP, SMB named pipes with credentialed lateral movement, raw promiscuous capture, and VMware's Virtual Machine Communication Interface (VMCI). Because VMCI traffic passes through the virtualization layer rather than a network adapter, a packet capture taken between two machines can miss VMCI traffic entirely. Reichel cites prior intrusions where UNC3886 used VMCI sockets for persistence between ESXi hosts and guest VMs, as documented by Mandiant.
Two instructions in the language watch for the trigger. In the analyzed build only the raw‑packet listener opcode is enabled; a DNS‑based trigger exists in the binary but is not active in this sample.
Indicators, detection tools, and limits Reichel published
- An unexpected dpapi.dll beside ERAAgent.exe
- An unexpected dpapisvc.dll in the same directory
- SHA‑256: d347170752a28e2b8c4b8b9f3cab2e3a6541ba11682c94498d26eb9002779d60
- MD5: 2318327b29bb1c0e2d2b5f0211fc7fac
- EveryoneIncludesAnonymous set to 1
- An unexpected entry in NullSessionPipes
Reichel published a YARA rule and a read‑only PowerShell scanner that checks these indicators across an estate. He also warned that the YARA rule keys partly on a static AES key and compiled protocol code, meaning a rebuild with different compiler settings could break detection. Reichel said detection coverage for the file was low at publication but did not state the basis for that assessment.
Operationally dangerous behaviors are present in the sample: to let unauthenticated callers reach its named‑pipe channel the backdoor sets EveryoneIncludesAnonymous and adds its pipe name to NullSessionPipes. Its cleanup routine records whether its own write to NullSessionPipes succeeded rather than whether an entry already existed, meaning removal can delete a legitimate entry that predates the infection.
What ESET customers, incident responders, and security teams should note
ESET has issued no advisory or public statement on the malware as of August 26. The Hacker News reported it reached out to ESET for comment and said it would update the story if ESET responded. Because the binary checks only the host process name and not signature or path, defenders should not assume a legitimate process name guarantees a clean binary in the same directory; the presence of an unexpected dpapi.dll or dpapisvc.dll beside ERAAgent.exe is a concrete red flag.
Reichel could not attribute the sample to any known actor, could not identify a victim, industry, or country, and could not determine whether the sample had ever been deployed. He described the analysis and offered direct contact for anyone who believes they have been targeted; his analysis toolkit and mitigation guide were not publicly available on his site or GitHub as of August 26.
This sample reads like a narrow, deliberate tool: no built‑in command‑and‑control addresses, a bespoke bytecode, multiple stealthy transports and a strict reliance on side‑loading and host context. Those design choices leave one clear operational implication — discovery will most likely come through endpoint inspection, configuration baselines, and incident response on confirmed matches rather than network‑based blocking of known infrastructure.
