SLEEPWALKER: a backdoor that ships its own 23-instruction language, and nothing to block until it wakes
Dominik Reichel's write-up describes a passive Windows implant with no listening port and no embedded payload. Recovering its AES key still leaves you holding bytecode for an interpreter only it understands.
The Watch · Security desk
What happened
- Researcher Dominik Reichel published an analysis of a passive Windows backdoor he calls SLEEPWALKER: no listening port, no embedded payload, idle in memory until one crafted packet arrives.
- The trigger packet delivers a program written in a 23-instruction command language of the implant's own design, not a readable command.
- The carrier is a 64-bit DLL impersonating Microsoft's dpapi.dll with a forged ESET Management Agent version resource, built to be side-loaded into ERAAgent.exe.
Why it matters
- What it limits constraint Key recovery no longer ends the analysis: a decrypted task is bytecode for a private interpreter, so incident work now includes reverse engineering a language before anyone can say what the...
- Who's exposed exposure The host-weakening step leaves a machine with anonymous SMB and Everyone-readable pipes whether or not the implant is ever triggered, which is exposure to the segment rather than to one operator.
- What doesn't add up contradiction The secondhand account reads as encrypted commands awaiting a magic packet, which understates the actual cost: the encryption is standard and the language is the obstacle.
- What it sets up precedent Reichel's judgement that this may be an early build with weak implementation sets the expectation that the next version keeps the interpreter and drops the noisy host changes.
Next story · Build · 1h ago
Microsoft ports Defender to the Linux desktop for Plan 2 and E5 or E7 customersConfirmed2 publishers
The two layers of opacity are worth separating, because only one of them is hard. The outer layer is ordinary cryptography: AES-256-CCM with a verified authentication tag, provided by a statically linked copy of mbedTLS rather than anything loaded at runtime, which also removes the runtime dependency a defender might otherwise notice [s1 c8][s1 c11]. The inner layer is where the analyst time goes. What comes out of the decryption is not readable text but a program for a bytecode interpreter that exists only inside this file, so a recovered key yields a blob whose meaning still has to be reconstructed instruction by instruction [s1 c2][s1 c3].
At rest, the file is close to inert. Its built-in configuration decrypts to a single bootstrap command: watch every network interface indefinitely for the trigger [s1 c8]. A memory scan hunting for command strings therefore finds a sniffer holding no orders, and a firewall has nothing to deny until the operator chooses to send one packet, which can sit inside traffic that looks entirely normal, including a crafted DNS query [s1 c9][s1 d3].
Count the ways in and the arithmetic is unfriendly. Reichel lists TCP, UDP, ICMP, SMB named pipes with lateral movement using supplied credentials, VMware's internal VMCI channel between a guest and its host, and raw-socket promiscuous sniffing, with DNS queries as a second trigger channel [s1 c9]. That is seven paths to cover [20]. The VMCI one deserves attention on its own terms: a guest-to-host channel is not where most network monitoring is pointed.
The durable artifact is not on the wire at all. To allow unauthenticated named-pipe access, the implant enables anonymous SMB access and creates pipes with permissions granted to Everyone and Anonymous Logon [s1 c10]. That is a configuration change that persists whether or not a trigger ever arrives, and it does not distinguish between the operator and anyone else on the segment [21]. It is also the sloppiest thing in the design, which fits Reichel's own assessment that the implementation has several weaknesses and is not top-notch work, possibly an early build [s1 c13].
The activation gate is similarly thin: SLEEPWALKER checks only the name of its host process, not its signature or path, and does nothing unless that name is ERAAgent.exe [s1 c6]. The carrier is an unsigned 64-bit DLL that copies ESET's file information and forges an ESET Management Agent version resource [s1 c5][s1 c17]. ESET's description of the agent, quoted in the write-up, is the reason the choice is not arbitrary: it connects managed endpoints and servers to the management platform and stores and enforces policies locally [s1 c7].
What is missing is context. Reichel says the code is unfamiliar to him and declines attribution, while judging the implant most likely one component of a targeted intrusion alongside others not yet identified [s1 c14]. SC Media, relaying The Register, records the same gap: no victim, industry or origin, for lack of collection context [s2 c16]. The published detection material is a YARA rule and a read-only scanner script in the appendix [s1 c15].
What to watch
- A later build that keeps the bytecode interpreter but drops the anonymous SMB access and Everyone/Anonymous Logon pipe permissions, removing the only host-side residue.
- Telemetry that supplies the missing collection context and pins a victim, sector or region, which would also make attribution arguable.
- Side-loading hosts other than ERAAgent.exe, or an activation gate stricter than a process-name string comparison.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence58
- Adoption10
- Hype gap+6
- Incentives35
- Confidence68
Perspective Coverage
3 publishers- Builder
- Builder 43%
- Operator
- Operator 52%
- Investor
- Investor 5%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
SLEEPWALKER is a passive backdoor that opens no obvious listening port and carries no payload inside itself; it waits in memory doing nothing until one specifically crafted network packet reaches the machine. It was discovered and named by Dominik Reichel.
- [2]
The trigger packet carries not a readable command but a short program written in a command language of the backdoor's own design, with 23 instructions covering scheduling, several ways to move data, staged file delivery and running code directly in memory.
- [3]
Recovering the encryption key is not enough to understand one of these programs; the internal command language must be reverse engineered as well.
- [4]
SLEEPWALKER never contacts a fixed C2 address; instead it sniffs the network for a covert trigger packet, then decrypts and runs an attacker-supplied task program delivered as bytecode.
- [5]
The compact bytecode interpreter's 23 instructions cover scheduling, staged payload delivery with SHA-256 verification and in-memory shellcode execution.
- [6]
Reichel assesses the implant as most likely part of a targeted attack that also includes other unidentified components, and says he cannot attribute the malware to any particular actor because the code is unfamiliar to anything he has seen before.
- [7]
SC Media reports the 23-instruction language detail according to a recent report by The Register, describes the implant as passively scanning for a "magic packet", and says the exact victims, industry and origin remain unknown due to a lack of collection context while Reichel has provided a toolkit for detection and mitigation.
- [8]
The carrier file is a 64-bit Windows DLL that impersonates Microsoft's dpapi.dll and has a forged ESET Management Agent version resource, designed to be side-loaded into ERAAgent.exe, the Windows executable for ESET Management Agent.
- [9]
SLEEPWALKER checks only the host process name, not its signature or path, and stays inactive unless that name is ERAAgent.exe.
- [10]
The configuration built into the file decrypts with AES-256-CCM and a verified authentication tag to a single bootstrap command: watch every network interface indefinitely for the trigger.
- [11]
Until the operator sends the crafted packet there is nothing on the network to block, and the trigger can arrive inside traffic that looks completely ordinary, including a crafted DNS query.
- [12]
Network capabilities include TCP, UDP, ICMP, SMB named pipes with lateral movement using supplied credentials, VMware's internal VMCI channel between a guest and its host, and raw-socket promiscuous sniffing; a second trigger channel can also carry commands in DNS queries.
- [13]
To facilitate unauthenticated named-pipe access, SLEEPWALKER actively weakens the host: it enables anonymous SMB access and creates named pipes with permissions granted to Everyone and Anonymous Logon.
- [14]
The write-up closes with an IOC section and an appendix containing a YARA rule and a read-only scanner script.
- [15]
The file is unsigned and copies ESET's file information.
- [16]
ESET describes the ESET Management Agent as an essential component of ESET PROTECT and ESET PROTECT On-Prem that connects managed endpoints and servers to the management platform and stores and enforces policies locally.
- [17]
All encryption is provided by a statically linked copy of mbedTLS rather than anything loaded at runtime.
- [18]
Reichel writes that the implementation has several weaknesses and is not top-notch malware engineering, that this could be an early version, and that newer and improved builds may exist.
- [19]
Reichel found the sample while working through a backlog after losing access to VirusTotal Intelligence at the start of the year.
- [20]
The implant supports seven distinct network paths: six transports plus the DNS trigger channel.
- [21]
The anonymous SMB access and Everyone/Anonymous Logon pipe permissions persist regardless of whether a trigger packet ever arrives, and grant access to any party on the segment rather than only the operator.
Sources
3 independent publishers whose own reporting we read for this story.
- Dominik Reichel
r136a1.dev
1 article · August 25, 2026
- scworld.comNew 'Sleepwalker' backdoor uses custom command language
1 article · August 25, 2026
- thehackernews.comNewly SLEEPWALKER Backdoor Waits for One Crafted Packet, Then Runs Its Own Bytecode
2 articles · August 26, 2026