SLEEPWALKER is a newly identified Windows backdoor built to wait rather than call home. Once placed on a compromised device, it can sit inactive for an extended period, only responding when an operator sends a carefully formed network packet.
That restraint makes the threat difficult to spot with tools that look for repeated connections to a command server.
It is designed to be loaded beside a legitimate security-management component, giving malicious code a trusted-looking place to run. Analysts at PolySwarm identified the malware and named it SLEEPWALKER.
PolySwarm said in a report shared with Cyber Security News (CSN) that their analysis says the sample has no identified threat actor, victim, campaign, delivery chain, or proven record of features used in a live intrusion.
The finding nonetheless matters to enterprise defenders. A backdoor that avoids routine beaconing can reduce the clues available to network monitoring teams, then give an intruder flexible access after the secret trigger arrives.
New Windows Backdoor Stays Completely Silent
The implant begins by checking that it is running within the expected management-agent process. It is an unsigned 64-bit Windows library that imitates a legitimate supporting component and is intended to launch through DLL side-loading, a technique also used in the C2Looper sideloading evasion case to hide hostile code behind familiar software.
Its stored configuration is deliberately sparse. Instead of a hard-coded command server, it instructs the malware to place available interfaces into promiscuous mode and watch indefinitely for traffic matching a defined encrypted packet format.
A valid packet clears framing checks and CRC-32 validation before its tasking is decrypted with AES-256-CCM. The malware then passes the result to its own command interpreter, allowing an attacker to issue work without creating the regular outbound beacon expected from many remote-access tools.
This passive design can leave legitimate management-agent traffic appearing normal while the implant waits. The trigger must still reach a monitored interface, suggesting the operator needs a position on, through, or near the victim network.
That requirement may limit use against isolated endpoints, yet it does not make the malware harmless: tasking received after activation can instruct the compromised host to create new routes for operator control.
The researchers recovered an encryption key from the analyzed library, but the decrypted content is not plain-language instruction text. It uses a proprietary bytecode structure, creating another obstacle for analysts trying to determine exactly what an operator asked an infected device to do.
Flexible Access Raises Detection Stakes
SLEEPWALKER supports 23 bytecode instructions for scheduling, repeated tasks, additional listeners, compressed payloads, local task files, and direct in-memory shellcode execution.
It also supports TCP, UDP, ICMP, Windows named pipes, DNS-based tasking, and VMware VMCI communications. Those options should be treated as possible capabilities, not confirmed activity.
The analyzed configuration enables only the raw-packet listener; DNS triggering, lateral movement, virtual-machine communications, and staged delivery were implemented in the code but were not shown to have been used. The malware can also adjust Windows settings to allow anonymous access to its named-pipe channel.
That behavior offers defenders a useful hunting lead, alongside unexpected library loading from management-agent folders and suspicious pipes, much like the PipeMagic named pipe investigation highlighted the value of watching uncommon local communication paths.
Security teams should validate library signatures and hashes, compare anonymous SMB and named-pipe settings with approved baselines, and investigate trusted processes loading unverified neighboring files.
Those checks are especially important because file reputation and blocklists alone may reveal little when there is no fixed command infrastructure.
Behavior-focused monitoring is therefore central. Teams should correlate process starts, unusual library loads, security-configuration changes, packet-capture evidence, and memory activity rather than treat any single signal as conclusive, an approach reinforced by the Mistic memory execution report.
For incident responders, the practical lesson is to preserve volatile evidence early and examine how a suspect process was launched.
SLEEPWALKER shows how an attacker can separate initial compromise from later control, remain quiet between actions, and make a familiar program part of the concealment strategy.
Indicators of compromise (IoCs):-
| Type | Indicator | Description |
|---|---|---|
| SHA-256 | d347170752a28e2b8c4b8b9f3cab2e3a6541ba11682c94498d26eb9002779d60 |
SLEEPWALKER sample hash |
| File name | dpapi.dll |
Unsigned malicious DLL masquerading as a legitimate Microsoft component |
| Process name | ERAAgent.exe |
Management-agent process targeted for DLL side-loading |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC
The post New Windows Backdoor Stays Completely Silent Until Hackers Send a Secret Trigger appeared first on Cyber Security News.