Ethical Hacking News
A new Windows backdoor, dubbed SLEEPWALKER, has been discovered that exploits a vulnerability in the Windows DLL search order to launch a persistent malware payload. The backdoor is capable of capturing all network traffic crossing each watched interface and relies on the security context of its host process rather than obtaining elevated privileges itself. This new threat highlights the importance of keeping endpoint security software up to date and patched, as well as the need for organizations to implement robust security controls to prevent lateral movement and data exfiltration.
The SLEEPWALKER backdoor is a post-compromise implant that relies on the security context of its host process, rather than obtaining elevated privileges. The backdoor is capable of staying dormant in memory until a specifically crafted network packet is received. The SLEEPWALKER backdoor is likely the result of a sophisticated attack, possibly carried out by a nation-state actor or a highly skilled threat actor. The backdoor is an unsigned 64-bit Windows dynamic-link library (DLL) that impersonates Microsoft's dpapi.dll. The SLEEPWALKER backdoor can capture all network traffic crossing each watched interface, making it a powerful tool for exfiltrating sensitive data. The backdoor relies on the security context of its host process, making it a post-compromise implant rather than an entry point. The discovery of SLEEPWALKER highlights the importance of keeping endpoint security software up to date and patched, as well as the need for organizations to implement robust security controls.
A recently discovered Windows backdoor, dubbed SLEEPWALKER, has been found to take advantage of a vulnerability in the Windows DLL search order to launch a persistent malware payload. The backdoor, which is capable of staying dormant in memory until a specifically crafted network packet is received, is described as a post-compromise implant that relies on the security context of its host process rather than obtaining elevated privileges itself.
According to independent malware researcher Dominik Reichel, who documented the SLEEPWALKER backdoor, its approach is "consistent with a targeted, well-resourced operation rather than an opportunistic one." This suggests that the backdoor may be the result of a sophisticated attack, possibly carried out by a nation-state actor or a highly skilled threat actor.
The SLEEPWALKER backdoor is an unsigned 64-bit Windows dynamic-link library (DLL) of 59,904 bytes, built to be side-loaded into ERAAgent.exe, the Windows executable for ESET Management Agent. The DLL impersonates Microsoft's dpapi.dll, exporting the same seven data protection functions as the genuine system library, and carries a version resource copied from ESET Management Agent.
There are no domains, IP addresses or URLs built into the file, and it makes no outbound connection of its own, so an infected host can look clean to tooling that watches for connections to known-bad infrastructure. However, the backdoor is capable of capturing all network traffic crossing each watched interface, including traffic addressed to other machines, making it a powerful tool for exfiltrating sensitive data.
SLEEPWALKER checks only the host process name, not its signature or path, and writing the file into that directory requires local administrator rights that an operator must already hold. The backdoor relies on the security context of its host process rather than obtaining those rights itself, making it a post-compromise implant rather than an entry point.
The only persistence mechanism for the backdoor is side-loading, which relies on Windows DLL search order rather than a flaw in ESET's software. The response to a confirmed match is incident response and a rebuild, which is a welcome relief for organizations that rely on ESET's products for endpoint security.
The 23 instructions that make up the SLEEPWALKER backdoor's bytecode language include scheduling, several ways to move data, staged file delivery verified against a SHA-256 hash before it runs, and executing code directly in memory. They ride on six transports, comprising TCP, UDP, ICMP, SMB named pipes with credentialed lateral movement, raw promiscuous capture, and VMware's Virtual Machine Communication Interface (VMCI).
VMCI traffic passes through the virtualization layer rather than a network adapter, so a packet capture taken between two machines misses it entirely. This means that attackers can use SLEEPWALKER to exfiltrate data from a compromised machine without being detected, making it a powerful tool for advanced persistent threats.
The discovery of the SLEEPWALKER backdoor highlights the importance of keeping endpoint security software up to date and patched, as well as the need for organizations to implement robust security controls to prevent lateral movement and data exfiltration.
Related Information:
https://www.ethicalhackingnews.com/articles/New-SLEEPWALKER-Backdoor-Exploits-Windows-DLL-Search-Order-Vulnerability-to-Launch-Persistent-Malware-Payload-ehn.shtml
https://thehackernews.com/2026/08/newly-sleepwalker-backdoor-waits-for.html
Published: Wed Aug 26 09:05:14 2026 by llama3.2 3B Q4_K_M
