New 'Sleepwalker' Backdoor Lurks in Windows Memory, Awaiting Custom Network Commands
A sophisticated new Windows backdoor, dubbed 'Sleepwalker,' has been identified that remains dormant in system memory until triggered by a specific network packet, employing a unique 23-instruction command language for its operations.
Security researchers have uncovered a novel and stealthy Windows backdoor named Sleepwalker, which operates by lying dormant in a compromised system's memory. Unlike typical backdoors that establish persistent connections to command-and-control (C2) servers, Sleepwalker waits passively for a specially crafted network packet, often referred to as a 'magic packet,' to initiate its malicious activities. This unique activation method allows it to evade traditional network monitoring tools that typically look for unusual outbound connections or communication with known malicious IP addresses.
Once activated by the magic packet, Sleepwalker decrypts and interprets commands written in its own custom 23-instruction language. This proprietary command set is not human-readable and requires reverse engineering to understand its full capabilities, which include executing code directly in memory, managing files, and exfiltrating sensitive data. The complexity of this command language suggests a targeted and well-resourced threat actor behind its development.
Further enhancing its stealth, Sleepwalker disguises itself as a legitimate Microsoft component, impersonating dpapi.dll, which is part of Windows' Data Protection API. It achieves this by exporting the same functions as the genuine DLL and attempting to load a non-existent companion file, dpapisvc.dll. The malware also employs DLL side-loading, embedding itself within the ERAAgent.exe process, the legitimate executable for ESET Management Agent, making it difficult to detect by standard antivirus solutions.
The backdoor's operational flexibility is further highlighted by its ability to use VMware's VMCI (Virtual Machine Communication Interface) as a target for network communication, in addition to standard network addresses. This capability could be leveraged in virtualized environments to maintain stealth and evade detection within segmented networks.
Researchers note that the absence of outbound network traffic from a potentially compromised machine does not rule out an infection by Sleepwalker. Because it only listens for specific incoming packets and does not initiate its own connections, it can remain hidden from network security appliances. The encryption used for commands, AES-256-CCM, adds another layer of obfuscation, requiring both the encryption key and an understanding of the custom command language to decipher malicious instructions.
Despite its sophisticated design, much about Sleepwalker remains unknown. Researchers have not yet been able to attribute the malware to a specific threat actor or campaign, nor is there any context linking the discovered sample to a confirmed intrusion, victim, or geographical region. The initial access vector and post-compromise activities are also unclear.
To aid in detection and remediation, the malware researcher who discovered Sleepwalker has developed a toolkit. This toolkit assists in decoding the malware's bytecode, analyzing network artifacts, and safely reproducing its communication pipeline without executing commands or generating outbound traffic. A mitigation guide and remediation script are also available for affected systems.
The discovery of Sleepwalker underscores the evolving tactics of sophisticated threat actors who are developing highly evasive malware that operates with minimal network footprint and relies on custom, complex command structures to maintain stealth and achieve their objectives.