Sleepwalker: A Passive Windows Backdoor That Waits for a Magic Packet
Malware doesn’t necessarily need to communicate with an attacker’s server to remain under their control. Researcher Dominic Reichel discovered a previously unknown Windows backdoor called Sleepwalker, which sits silently in memory and waits for a specially crafted network packet. Once it receives that signal, the program decrypts the embedded command and executes it.
Disguised as a Microsoft System File via DLL Sideloading
Sleepwalker hides inside a 64-bit DLL disguised as the legitimate Microsoft system file dpapi.dll. The malicious module gets loaded through DLL sideloading alongside ERAAgent.exe, a component of the ESET Management Agent. Once launched, Sleepwalker verifies the parent process name, remains resident in memory, and never establishes a conventional connection to a command-and-control server.
Waiting for a Magic Packet Instead of Calling Home
Rather than initiating an outbound connection, the backdoor passively inspects passing network traffic in search of a predetermined sequence known as a magic packet. Malware authors employed this same passive listening tactic as far back as the late 1990s. Reviving this older technique now works to Sleepwalker’s advantage, since it evades modern defenses designed to flag suspicious domains, open ports, and unusual outbound traffic. An infected machine can consequently go a long time without displaying any noticeable network activity at all.
A Custom 23-Instruction Command Language, Encrypted With AES-256-CCM
Sleepwalker’s commands are protected with AES-256-CCM encryption and rely on a proprietary binary language built from 23 distinct instructions. Through this language, an operator can transmit and conceal data, receive new tasks, open TCP and UDP ports, interact with Windows named pipes, download files, and execute code directly in memory. Certain instructions even allow communication with VMware VMCI targets.
A Sign of a Targeted, Well-Resourced Operation
Reichel considers Sleepwalker’s design a hallmark of a targeted and well-funded operation, though confirming its use in an actual attack remains impossible for now. The researcher has no data regarding victims, countries, or industries where the malicious module may have been deployed. The initial infection vector, Sleepwalker’s developers, and any potential connection to known threat groups also remain unknown.
Detection Tools and Remediation Guidance
For analysis purposes, Reichel prepared a set of tools that help parse Sleepwalker’s commands, encrypted data, and network artifacts without ever actually executing the malicious instructions. A separate guide outlines the appropriate response after discovering Sleepwalker and includes a remediation script for clearing an infection. The primary risk stems from the backdoor’s passive operating mode – meaning the absence of suspicious outbound connections alone does not rule out infection.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
