Windows Backdoor Waits for Secret Network Signal to Activate Commands

A previously undocumented Windows backdoor stays dormant in memory until a specially crafted network packet triggers it to execute commands in its own 23-instruction language, according to an analysis published by independent malware researcher Dominik Reichel. The malware, named SLEEPWALKER, is an unsigned 64-bit Windows DLL measuring 59,904 bytes, designed to be side-loaded into ERAAgent.exe, the Windows executable for ESET Management Agent. The file contains no domains, IP addresses, or URLs and initiates no outbound connections on its own, allowing infected machines to appear clean to tools that monitor for connections to known malicious infrastructure.

The backdoor disguises itself as Microsoft's dpapi.dll, exporting the same seven data protection functions as the legitimate system library, and includes a version resource lifted from ESET Management Agent. Its embedded configuration decrypts using AES-256-CCM into a single instruction directing the backdoor to watch every network interface indefinitely for the trigger packet. The listener intercepts all traffic crossing each monitored interface, including communications destined for other machines, meaning a gateway, VPN server, or host bridging two network segments could detect a trigger intended for an entirely different machine. Commands arrive as bytecode instead of human-readable text, so even after recovering the encryption key, an analyst finds only opcodes in a format that exists nowhere outside this single file. The 23 instructions handle scheduling, multiple methods of data transfer, staged file delivery verified against a SHA-256 hash before execution, and running code directly in memory, all supported by six transports: TCP, UDP, ICMP, SMB named pipes with credentialed lateral movement, raw promiscuous capture, and VMware's Virtual Machine Communication Interface (VMCI).

Reichel, a former Palo Alto Networks Unit 42 malware researcher, said the approach is "consistent with a targeted, well-resourced operation rather than an opportunistic one." The assessment relies on a single binary provided without collection context, and Reichel could not link the sample to any known threat actor, identify a victim, an industry, or a country, or confirm whether the sample was ever deployed in the wild. Two of the instructions monitor for the trigger, with the opcode stored in the analyzed sample activating only the raw-packet listener, while a second opcode also enables a DNS-based trigger implemented in the binary but inactive in this build. VMCI traffic passes through the virtualization layer rather than a network adapter, so a packet capture taken between two machines misses it completely; UNC3886 used VMCI sockets for persistence between compromised ESXi hosts and their guest virtual machines in intrusions documented by Mandiant.

SLEEPWALKER checks only the host process name, not its signature or path, and placing the file into the required directory demands local administrator rights that an operator must already possess. The backdoor depends on the security context of its host process rather than acquiring those privileges itself, making it a post-compromise implant rather than an entry point, and how an operator initially reached the machine and wrote the DLL into that directory remains unclear. Side-loading serves as its only persistence mechanism, with the DLL loading again each time the ESET Management Agent service starts; the side-loading exploits Windows DLL search order rather than a flaw in ESET's software, so there's nothing to patch, and the response to a confirmed match is incident response and a rebuild. ESET's products have been abused for side-loading before, including by ToddyCat, which Kaspersky said exploited a search-order flaw in the company's command-line scanner to load a malicious DLL into ESET. To allow unauthenticated callers to reach its named-pipe channel, SLEEPWALKER sets the EveryoneIncludesAnonymous registry value and adds its pipe name to NullSessionPipes, though its cleanup routine records whether its own write to NullSessionPipes succeeded rather than whether an entry was already present, so removal can delete a legitimate entry that predates the infection.

Reichel published host indicators including an unexpected dpapi.dll beside ERAAgent.exe, an unexpected dpapisvc.dll in the same directory, EveryoneIncludesAnonymous set to 1, and an unexpected entry in NullSessionPipes, noting the two registry values carry weight only against a known-good baseline. The writeup includes a YARA rule and a read-only PowerShell scanner that checks those indicators across an estate, though Reichel noted that detection coverage for the file was low at publication and that the YARA rule keys partly on a static AES key and on compiled protocol code, which a rebuild with different compiler settings could break. No instruction in the language writes to disk, so anything the backdoor expects to find on a compromised machine has to be placed there by another component. Organizations that use ESET Management Agent should verify the integrity of dpapi.dll files in their deployments, and anyone who believes they've been targeted should contact Reichel directly. Magic-packet implants of this kind have surfaced on Linux systems, including Red Menshen's use of passive backdoors like BPFDoor inside telecom operator networks, as documented by Rapid7. The shift from noisy beaconing to silent listening raises the bar for defenders who rely on network traffic analysis alone. Incident responders may need to prioritize host-based artifact sweeps over perimeter monitoring when hunting for implants that wait rather than call home.