Researcher discovers "sleepwalking" backdoor targeting Windows

A researcher has uncovered a new Windows backdoor that avoids the usual pattern of maintaining an active command-and-control connection by sitting dormant until it detects a specific network trigger.

Called Sleepwalker, the malware was discovered and analyzed by security researcher Dominik Reichel. Unlike a typical backdoor, it hides inside system memory and waits for a specially crafted packet before unleashing its fury.

Reichel described it as “a passive backdoor that opens no obvious listening port and carries no payload inside itself.”

The malware “waits in memory doing nothing at all until one specifically crafted network packet reaches the machine,” he wrote in his analysis.

That design makes Sleepwalker particularly difficult to spot through normal network monitoring.

“A machine can be fully compromised by this backdoor while producing nothing at all for a network monitor to flag,” Reichel wrote.

The malware arrives as an unsigned 64-bit Windows DLL that impersonates Microsoft's dpapi.dll, a legitimate Windows component. It is designed to load through DLL side-loading into ERAAgent.exe, the executable used by ESET Management Agent.

Once loaded, Sleepwalker decrypts a small configuration containing a single instruction: watch the network for its trigger. The rest of its capabilities are provided later by the operator.

The backdoor has a broad set of abilities. Its custom command language contains 23 instructions covering scheduling, data transfer, staged file delivery, and code execution directly from memory.

Given its sophistication, the researcher could not find evidence showing who developed Sleepwalker.

“I found no related code that would support attribution to a known group, and this one sample cannot establish when or how widely Sleepwalker was deployed, whether variants exist or whether it belongs to a continuing campaign,” Reichel wrote.

Windows keeps attracting stealthy malware

Sleepwalker is not an isolated example of attackers finding unusual ways to hide inside Windows environments. Recent campaigns have shown a similar preference for techniques that allow malware to blend into legitimate software or to use trusted components, rather than relying on obvious malicious infrastructure.

In one recent campaign, attackers used QEMU to run a hidden Linux virtual machine inside Windows. The approach gave them a way to maintain long-term access to a network and deploy malware while keeping much of their activity outside the normal Windows environment.

Attackers have also abused Microsoft's Hyper-V virtualization technology for a similar purpose in the past. By running a Linux environment inside Windows, they moved malicious activity into a virtual machine, which made it harder for conventional Windows security tools to detect.

In another campaign, attackers used the OpenAI Assistants API for command-and-control purposes with a backdoor dubbed SesameOp. The malware fetched encrypted commands through the API from an attacker-controlled OpenAI account and sent the results back through the same service.

These attacks highlight a problem that goes beyond any single Windows vulnerability – modern malware does not always look like malware. Attackers can hide it inside legitimate processes, run it inside virtual machines, or communicate through services that organizations already trust, making detection more difficult.