As cited
Copy frozen at (site build).
threat intel
You don't want this Sleepwalker backdoor on your Windows machine
Researchers discovered Sleepwalker, a previously unknown Windows backdoor that remains dormant in memory until activated by a specially crafted network packet containing commands in a custom 23-instruction language. The malware masquerades as Windows' dpapi.dll, loads via DLL side-loading into ESET Management Agent, and communicates through magic packets using AES-256-CCM encryption, avoiding typical detection by never initiating outbound connections or opening obvious listening ports. The backdoor's origin, victims, and deployment scope remain unknown, though its sophisticated design suggests a targeted, well-resourced operation.
Why it matters: Windows administrators and security teams need to detect Sleepwalker by examining ESET Management Agent processes and network patterns, as the malware's passive triggering mechanism and encrypted command language make it invisible to traditional network monitoring and antivirus tools.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
You don't want this Sleepwalker backdoor on your Windows machine
Researchers discovered Sleepwalker, a previously unknown Windows backdoor that remains dormant in memory until activated by a specially crafted network packet containing commands in a custom 23-instruction language. The malware masquerades as Windows' dpapi.dll, loads via DLL side-loading into ESET Management Agent, and communicates through magic packets using AES-256-CCM encryption, avoiding typical detection by never initiating outbound connections or opening obvious listening ports. The backdoor's origin, victims, and deployment scope remain unknown, though its sophisticated design suggests a targeted, well-resourced operation.
Why it matters: Windows administrators and security teams need to detect Sleepwalker by examining ESET Management Agent processes and network patterns, as the malware's passive triggering mechanism and encrypted command language make it invisible to traditional network monitoring and antivirus tools.
- Source published
- First seen by Cybersecurity Tracker