SLEEPWALKER: A Passive Backdoor That Speaks Its Own Language

SLEEPWALKER is a passive backdoor that doesn't phone home, doesn't open a listening port, and carries no payload. Instead, it sits in memory, sniffing the network for one specifically crafted packet. When that packet arrives, it wakes up and runs a program written in a command language of its own design.

The sample is a 64-bit Windows DLL that impersonates Microsoft's dpapi.dll and is designed to be side-loaded into ERAAgent.exe, the Windows executable for ESET Management Agent. It checks only the host process name, not its signature or path, so it stays dormant unless that name matches.

Once triggered, the backdoor interprets bytecode from a 23-instruction command language. These instructions cover scheduling, multiple data movement methods, staged file delivery with SHA-256 verification, and running code directly in memory. The encryption key alone isn't enough to understand a captured program—you also need to reverse engineer the interpreter.

Notably, SLEEPWALKER actively weakens the host to facilitate unauthenticated named-pipe access. It enables anonymous SMB access and creates named pipes with permissions granted to Everyone and Anonymous Logon. All encryption is handled by a statically linked copy of mbedTLS, avoiding runtime dependencies.

The network capabilities are broad: TCP, UDP, ICMP, SMB named pipes with lateral movement using supplied credentials, VMware's VMCI channel between guest and host, and raw-socket promiscuous sniffing. A second trigger channel can even carry commands in DNS queries.

This design makes SLEEPWALKER hard to catch from the network side. There's nothing to block until the operator sends that one crafted packet, and it can arrive inside traffic that looks completely ordinary. The author notes the implementation has weaknesses and might be an early version—newer builds could exist.