Sleepwalker backdoor hides in Windows by posing as ESET's own agent

Malware researcher Dominik Reichel has published a technical analysis of a previously undiscovered Windows backdoor called Sleepwalker. The malware masquerades as Microsoft's dpapi.dll, replicating all seven exported functions of the legitimate component, and reaches a machine through DLL side loading into ERAAgent.exe, the executable for ESET's Management Agent. Once it confirms it is running inside that expected host process, Sleepwalker goes fully dormant in memory, which is what lets it slip past traditional antivirus detection.

Unlike a typical backdoor that phones home to a command-and-control server, Sleepwalker never initiates contact on its own. It sits passively, watching network traffic for a specific pattern Reichel calls a magic packet. When one arrives, the backdoor decrypts the payload with AES-256-CCM encryption and runs it as a command. Reichel said the packet does not carry a readable instruction but a short program written in a command language of the backdoor's own design, with 23 distinct instructions covering scheduling, several ways to move data, staged file delivery and running code directly in memory. Four of the 23 instructions handle data transmission, including one that opens TCP connections to a chosen address and port (with support for using a VMware VMCI target instead of a standard network address) and another that writes data to Windows named pipes with optional credential authentication. Five more instructions handle inbound task reception over TCP/UDP ports and named pipes, and a further five focus on building and executing programs.

Reichel argues the design points away from an opportunistic attack: because the backdoor never sends anything out unprompted and does not open an obvious listening port by default, tools that watch for connections to known-bad domains or unusual outbound traffic will not flag anything. He described the overall approach as consistent with a targeted, well-resourced operation.

Much about Sleepwalker remains unknown. Reichel has no collection context tying the sample to a confirmed intrusion, so he cannot name a victim, industry, country or affected organization, and he found no related code supporting attribution to any known group. He also cannot establish when or how widely the backdoor was deployed, whether variants exist, or whether it belongs to an ongoing campaign, and the infection vector, meaning how attackers first reach a system or deliver the malicious DLL, is unclear. For potentially affected systems, Reichel has released diagnostic tools for decoding the bytecode and examining encrypted artifacts, a way to safely reproduce the receiving pipeline without executing commands or transmitting traffic, and a remediation script for cleanup after detection. He is asking anyone who believes they are affected to contact him directly.

Key facts

Sleepwalker disguises itself as Microsoft's dpapi.dll, replicating all seven of its exported functions, and side-loads into ESET's ERAAgent.exe management-agent executable.
It stays fully passive and dormant in memory, activating only when it detects a specially crafted magic packet, which it decrypts with AES-256-CCM before executing.
Its proprietary command language has 23 instructions: 4 for data transmission, 5 for inbound task reception, 5 for building and executing programs, plus others for scheduling and staged file delivery.
One data-transmission instruction can target a VMware VMCI channel instead of a standard network address; another writes to Windows named pipes with optional credential authentication.
Researcher Dominik Reichel found no victim, attribution, deployment date or infection vector, and has released diagnostic and remediation tools for anyone who suspects they are affected.

Why it matters

Most backdoors give themselves away sooner or later because they have to talk to a command-and-control server. Sleepwalker is built to avoid exactly that tell: it never initiates a connection on its own and opens no listening port by default, so it stays invisible to the network monitoring that catches ordinary malware. Reichel called the overall design consistent with a targeted, well-resourced operation rather than an opportunistic one, and the choice to impersonate a legitimate Windows component while side-loading through a real security vendor's own agent process is a deliberate piece of that design.

Who it affects

The malware side-loads specifically into ERAAgent.exe, the executable for ESET's Management Agent, so any Windows environment running that agent is the relevant population. Reichel has no collection context tying the sample he found to a confirmed intrusion, and explicitly says he cannot identify a victim, industry, country or affected organization from what he has. There is no evidence in the analysis that ESET itself or any specific ESET customer has been compromised, only that the agent's process is used as the side-loading vector.

How to use it

Reichel has published diagnostic tooling for organizations that suspect they are affected: a toolkit for decoding Sleepwalker's bytecode, examining encrypted artifacts, and safely reproducing the backdoor's receiving pipeline without actually executing its commands or transmitting traffic. He has also released a remediation script for cleanup once the backdoor has been detected, and asks anyone who believes they are affected to contact him directly.

How solid is it

This is a named researcher's own technical reverse-engineering write-up, not a secondhand report: Reichel documents the command language, the encryption scheme, the side-loading mechanism and the instruction set in detail, and the piece runs under The Register's Infosec desk as straight reporting rather than opinion or humor. The specifics, such as the 23 instructions and the seven replicated dpapi.dll functions, come directly from his analysis of a sample.

Risks and caveats

The unknowns are as notable as the findings. Reichel found no related code that would support attribution to a known group, cannot establish when or how widely Sleepwalker has been deployed, cannot say whether variants exist or whether it belongs to a continuing campaign, and does not know how attackers initially access a system or deliver the malicious DLL. Nothing in the source indicates whether ESET or any of its customers were actually compromised, only that the agent process is used as a side-loading target.

“What makes it worth writing up is what that packet carries: not a readable command, but a short program written in a command language of the backdoor's own design. Its 23 instructions cover scheduling, several ways to move data, staged file delivery and running code directly in memory.”

— Dominik Reichel, malware researcher