Sleepwalker: New Windows Backdoor Hides in Memory Until a 'Magic Packet' Wakes It

Sleepwalker is a passive Windows backdoor documented by malware researcher Dominik Reichel and reported by The Register on 2026-08-24. Unlike beaconing malware that repeatedly checks in with a command server, Sleepwalker sits quietly in memory and only reacts once it receives a specific, specially crafted network packet, described as a 'magic packet', that tells it to wake up.

Once triggered, the backdoor decrypts attacker instructions using AES-256-CCM and executes them through a custom 23-instruction command language. Per the analysis, these commands cover moving data off the machine, receiving additional malware, and running code directly in memory rather than dropping traditional files to disk.

Most detection approaches flag malware by watching for an infected machine repeatedly contacting a suspicious external address. Sleepwalker's passive design sidesteps that pattern: it produces no regular outbound traffic to monitor until the trigger packet arrives, so a compromised host can look clean on a network dashboard for an extended period.

Reichel told researchers Sleepwalker's engineering is more consistent with a targeted, well-funded operation than malware spread widely for opportunistic infection, though no attribution has been confirmed.

The backdoor ships as a 64-bit Windows DLL named dpapi.dll, the same filename as a legitimate Microsoft Windows Data Protection API component, which can make the malicious copy harder to distinguish from a genuine system file at a glance.

Sleepwalker also embeds fake metadata claiming it belongs to ESET Management Agent and uses DLL side-loading: it checks whether it has been loaded by ERAAgent.exe, the legitimate ESET Management Agent executable, and stays inactive if it isn't running inside that process. When the check passes, it spawns a background process, allocates memory for incoming instructions, and begins monitoring traffic for the activation packet.

• Supports TCP, UDP, and ICMP as trigger channels
• Can communicate via SMB named pipes for lateral movement
• Includes VMware VMCI support for guest-to-host communication inside virtual machines
• Contains an inactive DNS-based trigger mechanism not enabled in the analyzed sample

Only one Sleepwalker sample has been analyzed to date, and researchers have not identified confirmed victims, targeted sectors, or specific countries affected. The sample reportedly contains several weaknesses, suggesting it may be an early or still-developing version of the malware rather than a mature, widely deployed tool.

Because the sample requires ESET Management Agent's ERAAgent.exe process to activate, organizations running that legitimate security tool alongside unmanaged or unverified DLLs in the same directory face a plausible, though not yet confirmed, exposure path.

Reichel has released indicators of compromise, a YARA detection rule, and a read-only PowerShell scanner to help defenders check for the specific Sleepwalker sample analyzed so far. Security teams can run the scanner against endpoints, particularly those running ESET Management Agent, to check for the malicious dpapi.dll and its side-loading behavior.

• Search for dpapi.dll files outside the expected system location or with mismatched signing
• Run the published YARA rule against endpoint file repositories
• Use the PowerShell scanner to identify the known sample
• Monitor ERAAgent.exe process loads for unexpected DLL side-loading

Because only a single sample exists and it appears to be an early build, further Sleepwalker variants could emerge with the DNS trigger enabled or with the identified weaknesses fixed. Defenders should watch for updated research from Reichel or other analysts, and revisit their DLL side-loading detection coverage generally.

Sleepwalker lets an attacker run code, exfiltrate data, and pull in extra payloads on a compromised Windows host while producing almost none of the outbound beaconing that network monitoring tools normally flag.

Security: Because Sleepwalker avoids regular command-and-control callbacks, detection tools that rely on spotting recurring outbound connections to a suspicious server are less likely to catch an infected host before the attacker sends the activation packet.

Privacy: Once active, the 23-instruction command set can move data off the infected machine, giving an attacker access to whatever files or information the compromised account can reach.

Sleepwalker is a newly documented passive Windows backdoor that hides as a fake dpapi.dll inside ESET Management Agent's ERAAgent.exe and only responds after a hidden network trigger.