SLEEPWALKER backdoor hides inside ESET's management agent

Independent malware researcher Dominik Reichel, who publishes his analysis at r136a1.dev, says losing access to VirusTotal Intelligence at the start of the year forced him to work through his analysis backlog instead of hunting new samples; that backlog work led to a detailed examination of a separate piece of malware called BeheMOF, and also to the discovery of SLEEPWALKER. A sample that looked unremarkable at first turned out, once he looked closer, to be a passive backdoor built around a fully custom command language, which he named SLEEPWALKER for the way it does nothing until it is deliberately woken.

SLEEPWALKER is an unsigned 64-bit Windows DLL, 59,904 bytes in size, compiled on 2024-06-10. It impersonates Microsoft's dpapi.dll, copying that file's name and its seven exported data-protection functions (CryptProtectDataNoUI, CryptProtectMemory, CryptResetMachineCredentials, CryptUnprotectDataNoUI, CryptUnprotectMemory, CryptUpdateProtectedState and iCryptIdentifyProtection), and carries a forged version resource lifted from ESET's real Management Agent. It is built to be side-loaded into ERAAgent.exe, the executable ESET describes as the essential component that connects managed endpoints to ESET PROTECT and ESET PROTECT On-Prem and enforces policy locally. The DLL checks only that the host process is literally named ERAAgent.exe, not its signature or file path, so it activates inside any process carrying that exact name. When something finally calls one of the seven forwarded DPAPI functions, a resolver tries to load a file called dpapisvc.dll to find the genuine function and patch its address into a pointer table; that filename matches no real Windows component (the closest real name, dpapisrv.dll, is unrelated and exports only two LSA functions), and if the load fails the resolver kills the entire host process rather than just that one call. Reichel notes that a fuller version of the attack could plant a renamed copy of the real dpapi.dll under that exact name, but the analyzed sample does not carry one.

On load, SLEEPWALKER starts a background thread, reserves a 128 KB memory buffer for assembling staged programs, and decrypts the single bootstrap instruction built into the file: watch every network interface, with no time limit, for a trigger. The decryption uses AES-256-CCM, which Reichel confirmed by recovering the embedded key and nonce himself and verifying that the resulting authentication tag is valid. The backdoor never contacts anything on its own; no domain, IP address or URL is built into it. Instead it puts up to eight network interfaces (skipping loopback and self-assigned addresses) into promiscuous mode and checks every packet crossing them against a multi-step test, including a minimum length, a checksum derived from XORing packet fields, and a CRC-32 check on the referenced block, before attempting an AES-256-CCM decrypt; anything that fails a step is silently dropped, and only a packet clearing every step is treated as a command. After one successful trigger it waits at least three seconds before it will accept another. A second, DNS-based covert trigger also exists in the binary and would let a command reach the backdoor across boundaries that block raw packets, but it runs through a separate opcode that the analyzed sample does not switch on: only the raw-packet trigger is active in this build.

What the trigger ultimately delivers is not a readable command but a program in a bytecode language of the backdoor's own design, 23 distinct instructions in total. They cover basic control (halt everything, or spawn a background copy of the listener), timing and scheduling (fixed or randomized pauses, cron-style schedules, fixed repeats, infinite loops), sending or receiving data over six underlying transports (TCP, UDP, ICMP, SMB named pipes that can log in with supplied credentials for lateral movement, VMware's own VMCI channel for a covert guest-to-host or guest-to-guest link that never touches a physical network adapter, and a raw, promiscuous-mode socket), assembling and running programs delivered in pieces (writing chunks into the shared buffer, verifying the assembled result against a supplied SHA-256 fingerprint before running it, decompressing a packed program, or executing raw shellcode directly in memory), and reading a file already on local disk, decrypting it the same way as any network-delivered command, and running the result. Instructions can nest inside each other, so a single schedule can, for example, contain a listener that itself waits for a file to be staged and hash-verified before it runs. Recovering the encryption key is not enough to read one of these programs, Reichel writes: the command language itself still has to be reverse-engineered separately.

To make its named-pipe channel reachable without credentials, SLEEPWALKER weakens the host: it enables anonymous SMB access and creates its pipes with permissions open to Everyone and Anonymous Logon. Its own cleanup code tries to reverse this afterward, but because it only tracks whether it successfully added the relevant registry entry rather than whether that entry already existed, cleanup can end up deleting a setting that predates the infection. None of this involves privilege escalation: the registry keys it touches already require administrator rights, which the backdoor inherits from its host process rather than obtaining on its own. Reichel also found that two independent code paths, one run when the DLL first loads and one run on the first forwarded DPAPI call, execute the identical startup sequence without either checking whether the other already ran, a bug he identifies as the source of a duplicate-worker problem. Weighing the design against these gaps, he calls SLEEPWALKER's approach cool from a reverse-engineering standpoint but says the implementation has several weaknesses and is not top-notch malware engineering, and thinks this could be an early build with newer, improved versions still out there.

Reichel could not attribute SLEEPWALKER to any actor, since the code resembles nothing he has seen before, but he assesses that a passive implant triggered this way, using several covert transports including VMCI and deployed by side-loading into a trusted ESET component, is most likely one piece of a larger targeted operation whose other pieces (an initial-access method, a trigger generator, a task builder) are not present in this single file and remain unidentified. He has no evidence tying the sample to a confirmed intrusion, victim, industry or country, and cannot confirm it was ever successfully deployed; the only task actually stored in the analyzed file is the one that starts the raw-packet listener, so everything else the bytecode can do describes capability rather than observed behavior. At the time of publication, Aug 24, 2026, he had found no earlier public reporting of SLEEPWALKER, and detection coverage for the file remained low. He published the file's SHA-256 hash, d347170752a28e2b8c4b8b9f3cab2e3a6541ba11682c94498d26eb9002779d60, alongside other indicators, released a YARA rule and a read-only scanner script that he checked against the real sample, and made a password-protected copy of the sample itself available to other researchers, while asking for help filling in what he could not establish: how it was delivered, what accompanied it, and which commands were actually sent.

SLEEPWALKER was also one of several samples Reichel used to compare AI models on reverse-engineering Windows malware. He did an initial manual pass himself, then had Claude Opus 5 and GPT-5.6-Sol handle the detailed analysis and verification, calling in Opus 4.8 and Sonnet 5 when safety restrictions stopped Opus 5 partway through; he had planned to include Kimi K3 but was still waiting for access, and excluded Fable because its filters blocked even general questions with dual-use answers. On this sample the two families came out close overall, Claude ahead on some parts, GPT on others, with one clear gap: on three separate attempts Claude described the raw-packet trigger opcode and its DNS-aware counterpart as functionally identical, while GPT correctly identified on its first attempt that only the DNS-aware one also enables the DNS-based trigger. Reichel's broader experience favored GPT operationally too: its weekly usage allowance suited long sessions better than Claude's hourly limit, and none of his GPT runs were interrupted by a safety refusal even though he is not enrolled in a program he refers to as Trusted Access for Cyber, whereas he eventually hit a refusal in every malware-analysis run with Claude Opus or Sonnet, sometimes early and sometimes after substantial progress, despite being accepted into Anthropic's own Cyber Verification Program. In his stated opinion, Anthropic should screen applicants for such programs more strictly and, in exchange, place fewer restrictions on researchers it has approved for legitimate reverse engineering. He otherwise describes AI as a powerful accelerant for this kind of work, turning analyses that used to take hours to months into a fraction of the time, while stressing that it does not remove the need for expertise or for checking every result against the actual code.

Key facts

SLEEPWALKER is a passive Windows backdoor that opens no listening port and beacons to no server: it waits silently until one specifically crafted network packet, or a hidden DNS query, arrives, then decrypts and runs a program written in its own 23-instruction bytecode language.
The 59,904-byte DLL impersonates Microsoft's dpapi.dll, copies its seven exported functions, and carries a forged ESET Management Agent version resource so it can be side-loaded into ERAAgent.exe, the real ESET agent executable; it checks only that process name, not the process's signature or file path.
Once triggered, its bytecode can chain scheduling, six network transports, including SMB named pipes for credentialed lateral movement and VMware's guest-to-host VMCI channel, staged file delivery checked against a supplied SHA-256 fingerprint, and direct in-memory shellcode execution.
Researcher Dominik Reichel found no earlier public reporting of SLEEPWALKER and said detection coverage for the file remained low as of publication on Aug 24, 2026; he could not attribute the backdoor to any known actor.
Testing AI models on the same sample, Reichel hit a Claude safety refusal in every malware-analysis run with Opus or Sonnet, despite being accepted into Anthropic's Cyber Verification Program, while none of his GPT-5.6-Sol runs were interrupted.

Why it matters

Most backdoors give themselves away by talking to a server somewhere, which is exactly what network defenses are built to catch. SLEEPWALKER does not: it makes no outbound connection on its own, carries no address inside itself, and only becomes visible on the wire for the instant its operator sends one hand-crafted packet that looks like ordinary traffic. Wrapping the actual instructions in a private bytecode language, rather than sending readable commands, adds a second layer: even someone who recovers the encryption key still has to reverse-engineer the 23-instruction language before they can tell what a captured program does. The writeup also lands as a real data point in the argument over AI safety filters and security research: on this same reverse-engineering task, Reichel found Claude's safety refusals, not any gap in ability, to be the main practical obstacle, even though he had been formally vetted through Anthropic's own Cyber Verification Program.

Who it affects

The realistic target is a 64-bit Windows endpoint or server running ESET Management Agent, the component ESET describes as essential to ESET PROTECT and ESET PROTECT On-Prem, meaning organizations that run ESET's centrally managed security product rather than individual home users. Because the check that wakes SLEEPWALKER looks only at the process name ERAAgent.exe, any machine where that exact name and the malicious DLL end up together is exposed, whatever the process's real signature or file path would otherwise show. Separately, the piece speaks directly to AI vendors and to security researchers who rely on AI tools for malware analysis: it is a named researcher's documented account of Claude and GPT-5.6-Sol on the same real-world task, including where Claude's own safety policy, not its analysis, got in the way.

How to use it

There is no product here, only defensive follow-up. Reichel published the SHA-256 hash of the analyzed file (d347170752a28e2b8c4b8b9f3cab2e3a6541ba11682c94498d26eb9002779d60) along with other indicators: an unexpected dpapi.dll or dpapisvc.dll sitting beside ERAAgent.exe, the EveryoneIncludesAnonymous registry value set to 1, and an unexplained entry in NullSessionPipes, while cautioning that the registry values need comparison against a known-good baseline and are not proof by themselves. The appendix adds a YARA detection rule and a read-only scanner script, both checked against the real sample and described as starting points rather than finished tools, plus a password-protected copy of the sample for other researchers to examine. He closes by asking for help with what his own analysis could not establish: how the file was delivered, what tools accompanied it, and which commands an operator actually sent.

How solid is it

The technical claims rest on hands-on work rather than assertion: Reichel recovered the AES-256 key and nonce embedded in the DLL, used them to decrypt the built-in configuration, confirmed its authentication tag checks out, and walked through the bytecode format instruction by instruction with worked examples. He identifies himself as the writeup's author only in the metadata of the appendix's YARA rule rather than in the post's visible byline, but that self-identification is part of the material he published. He is explicit about the limits of a single-sample analysis: no victim, industry or country is identified, he cannot confirm SLEEPWALKER was ever successfully deployed, and the only task actually found stored in the file is the one that starts the listener, so everything else the bytecode can do is capability, not observed attack behavior. The AI-comparison section is presented as his own testing on a self-selected sample set, and his call for Anthropic to loosen restrictions on vetted researchers is offered explicitly as his opinion, not as an established conclusion.

Risks and caveats

SLEEPWALKER's own cleanup is unreliable: because it only tracks whether it successfully added a NullSessionPipes entry, not whether one already existed, running that cleanup can delete a setting that predates the infection. Two independent code paths, one at DLL load and one on the first forwarded DPAPI call, run the identical startup sequence with no check for whether the other already ran, which Reichel identifies as a duplicate-worker bug, part of why he rates the implementation below top-notch and suspects this could be an early build. A fuller attack would still need pieces this single file does not contain (a delivery method, a trigger generator, a task builder), and none of them are identified. He could not attribute the backdoor to any actor, and because it never beacons and opens no listening port, ordinary traffic-monitoring tools would show nothing unusual on an infected machine between triggers. Separately, his finding that Claude produced a refusal in every malware-analysis run while GPT-5.6-Sol did not is one researcher's experience on a limited set of samples, not a controlled study.

“I eventually encountered a refusal in every malware-analysis run with Claude Opus or Sonnet.”

— Dominik Reichel, the researcher behind the SLEEPWALKER writeup