Reported by 2 outlets

Timeline

1. original reporting

   SLEEPWALKER Backdoor Uses SMB, ICMP, DNS and VMware VMCI for Covert Communications

   cyberpress.org · 47d ago · August 27th, 2026

   Researchers have uncovered a previously unknown Windows backdoor named SLEEPWALKER that can receive attacker commands through covert channels including raw network packets, DNS queries , SMB named pipes, ICMP ping traffic, and VMware’s VMCI communication layer. The malware is designed to remain dormant and avoid the usual signs of compromise. It does not contact a hard-coded command-and-control server, open a default listening port, or include an embedded final-stage payload. Instead, it waits for a specially crafted and encrypted trigger packet before activating. SLEEPWALKER was found as an unsigned 64-bit DLL impersonating Microsoft’s dpapi.dll . The sample copies version information from ESET Management Agent and is built to be side-loaded by ERAAgent.exe , the ESET Management Agent executable. It checks the host process name and remains inactive unless it runs inside that process. SLEEPWALKER Covert Comms Once activated, SLEEPWALKER decrypts and executes attacker-supplied bytecode through a custom command interpreter. The malware supports 23 instructions for scheduling tasks, transferring data, receiving follow-up programs, assembling staged payloads, decompressing code, and running shellcode directly in memory. The three command-line entry points: the local-only web UI, the standalone bytecode decoder, and the decoy listener that mimics the implant’s receiving transports without executing anything (Source: r136a1) Its built-in configuration contains only one function: co

2. update from gbhackers.com

   SLEEPWALKER Backdoor Uses Magic Packet, DLL Side-Loading and In-Memory Shellcode Execution

   gbhackers.com · 47d ago · August 27th, 2026

   A newly documented Windows backdoor named SLEEPWALKER combines passive network monitoring, DLL side-loading, and encrypted bytecode to remain dormant until attackers deliver a precisely crafted trigger packet. The malware does not beacon to a conventional command-and-control server, making it particularly difficult to identify through outbound-traffic monitoring alone. The 59,904-byte unsigned file masquerades as Microsoft’s dpapi.dll […] The post SLEEPWALKER Backdoor Uses Magic Packet, DLL Side-Loading and In-Memory Shellcode Execution appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .

3. update from gbhackers.com

   SLEEPWALKER Malware Uses Raw Packets, DNS and VMware VMCI for Covert Communications

   gbhackers.com · 42d ago · September 1st, 2026

   A newly analyzed Windows backdoor named SLEEPWALKER uses a passive command-and-control model designed to evade conventional beaconing-based detections. Raw-packet activation, DNS-based tasking support, VMware VMCI communications, named-pipe capabilities, and in-memory payload execution. No threat actor, victim, delivery chain, or live campaign has yet been attributed to the malware.

4. update from cyberpress.org

   SLEEPWALKER Backdoor Hides Inside ESET Agent and Awakens Only on Network Trigger

   cyberpress.org · 42d ago · September 1st, 2026

   Unlike conventional backdoors that regularly contact command-and-control (C2) servers, SLEEPWALKER does not contain fixed C2 domains, IP addresses, URLs, or second-stage payloads. It carries version information copied from the legitimate ESET Management Agent , helping it blend into a trusted software environment. Researcher Dominik Reichel discovered SLEEPWALKER and assessed that its design is more consistent with a targeted and well-resourced operation than opportunistic malware. SLEEPWALKER Backdoor Awakens Before starting its main functionality, SLEEPWALKER checks whether the host process is named ERAAgent.exe . It then launches a background thread, allocates memory, decrypts its bootstrap instruction, and starts a custom bytecode interpreter. This directs the malware to monitor available network interfaces for a matching trigger. The implant can place interfaces into promiscuous mode and inspect packets for the expected structure. When a valid trigger arrives, SLEE