New SLEEPWALKER Backdoor Waits for One Crafted Packet, Then Runs Its Own Bytecode
Summary: A researcher documented a previously unreported Windows backdoor called SLEEPWALKER, an unsigned 59,904-byte 64-bit DLL that side-loads into ERAAgent.exe by impersonating Microsoft's dpapi.dll and exporting the same seven data protection functions. It stays inert until a crafted packet arrives, then runs commands in a 23-instruction bytecode language, with no embedded domains, IPs or URLs and no outbound connections of its own.
What you should know: The implant listens promiscuously on every interface, so a gateway, VPN server or segment-bridging host can see a trigger meant for another machine, and its VMCI transport passes through the virtualization layer where packet capture between two machines misses it entirely. ESET says the scenario's security relevance is 'rather negligible' because writing the DLL requires administrator rights, and reports it has not observed the file in its telemetry.
Read the original at The Hacker News ↗
- Topics
- Privacy
- Related
- Italy Fines Meta €805 Million Over Facebook's Android Gallery Access Without Explicit Consent Cyber Risks · Nov 15, 2026