SLEEPWALKER Backdoor Hides in dpapi.dll and Runs Bytecode on One Packet

A previously unreported Windows backdoor called SLEEPWALKER sits in memory doing nothing at all until one crafted network packet reaches the machine. Independent researcher Dominik Reichel, formerly of Palo Alto Networks Unit 42, documented the sample as an unsigned 64-bit DLL of 59,904 bytes built to be side-loaded into ERAAgent.exe, the executable for ESET Management Agent. This analysis draws on reporting from The Hacker News.

The disguise is careful. The file impersonates Microsoft's dpapi.dll, exporting the same seven data protection functions as the genuine system library, and it carries a version resource copied from ESET Management Agent. If your endpoint tooling checks for a plausible-looking DLL next to a trusted security agent, it finds one.

What makes this build unusual is what the file does not contain. There are no domains, IP addresses or URLs embedded in it, and it never makes an outbound connection of its own. An infected host looks clean to anything watching for beacons to known-bad infrastructure, because there is no beacon to catch.

Its embedded configuration decrypts with AES-256-CCM into a single instruction telling the backdoor to monitor every network interface indefinitely for that trigger packet. The listener captures everything crossing each watched interface, including traffic addressed to other machines. A gateway, VPN server or host bridging two segments can therefore pick up a trigger intended for a completely different system on your network.

Commands arrive as bytecode written in a 23-instruction language of the author's own design. Recovering the encryption key gives you opcodes in a format that exists nowhere except inside this one file, which means normal string and command-line analysis produces nothing readable.

Reichel said the approach is "consistent with a targeted, well-resourced operation rather than an opportunistic one."

He could not attribute the sample to a known actor, name a victim, industry or country, or confirm the backdoor was ever deployed. The assessment rests on a single binary supplied with no collection context.

Attribution and Campaign Targets: Red Menshen, ToddyCat, and UNC3886 Operations

Attribution for SLEEPWALKER is unresolved. Reichel worked from a single binary supplied with no collection context, and he could not tie the sample to a known actor, name a victim, identify an industry or country, or confirm the malware was ever deployed against a live target. For anyone assessing exposure, that means there is no campaign profile to match your organization against, only file and registry artifacts to look for.

The three named groups in the reporting appear as precedent for individual techniques, not as candidates for authorship. ToddyCat abused ESET's command-line scanner, exploiting a DLL search-order flaw to load a malicious DLL into the product, according to Kaspersky. That establishes ESET software as a repeat side-loading target, and it is the closest operational parallel to how SLEEPWALKER reaches execution.

UNC3886 used VMware VMCI sockets for persistence between compromised ESXi hosts and their guest virtual machines, documented by Mandiant. SLEEPWALKER carries VMCI as one of its six transports alongside TCP, UDP, ICMP, SMB named pipes, and raw promiscuous capture. VMCI traffic crosses the virtualization layer instead of a network adapter, so a capture placed between two virtual machines records nothing of that channel, and a virtualized estate loses its usual east-west visibility for that path.

Red Menshen operated passive backdoors including BPFDoor inside telecom operator networks, per Rapid7. That is the family resemblance: a magic-packet implant that holds no outbound infrastructure and waits for a trigger. BPFDoor is a Linux implant and a separate lineage, so treat it as a comparable design rather than a shared codebase or a toolchain component.

The same distinction applies to dpapisvc.dll. It is a second unexpected file that Reichel lists as an indicator in the same directory as the host executable, so it belongs in the artifact set for this one sample rather than to any other actor's tooling.

The published host indicators are:

• SHA-256: d347170752a28e2b8c4b8b9f3cab2e3a6541ba11682c94498d26eb9002779d60
• MD5: 2318327b29bb1c0e2d2b5f0211fc7fac
• An unexpected dpapisvc.dll in the host process directory
• EveryoneIncludesAnonymous set to 1
• An unexpected entry in NullSessionPipes

The two registry values only mean something measured against a known-good baseline, since both have legitimate uses. There are no domains, IP addresses or URLs to hunt, because none are compiled into the file and the implant makes no outbound connection of its own.

Mapped to MITRE ATT&CK, the observed behavior covers:

• T1574.001 Hijack Execution Flow: DLL Search Order Hijacking, and T1547 Boot or Logon Autostart Execution, since the DLL loads each time the host service starts
• T1036.005 Masquerading: Match Legitimate Name or Location
• T1140 Deobfuscate/Decode Files or Information, covering the AES-256-CCM configuration decrypt and the custom bytecode
• T1205 Traffic Signaling for the crafted-packet trigger, with T1040 Network Sniffing for the promiscuous listener
• T1112 Modify Registry for the anonymous named-pipe changes, and T1021.002 SMB/Windows Admin Shares for the credentialed lateral movement over that pipe
• T1105 Ingress Tool Transfer for staged file delivery checked against a SHA-256 hash, and T1620 Reflective Code Loading for in-memory execution

Reichel noted the accompanying YARA rule keys partly on a static AES key and on compiled protocol code, both of which a rebuild with different compiler settings could break. The hash and rule set therefore identify this build, and a second build from the same operator would need new signatures.

Business and Operational Impact of Undetected Backdoor Access

SLEEPWALKER contains no domains, IP addresses or URLs, and it never initiates an outbound connection. If your detection strategy rests on matching traffic against known-bad infrastructure or spotting beaconing intervals, an infected host produces nothing to match. The practical consequence is that the machine looks clean on your network telemetry for as long as the operator chooses to leave it alone.

That silence is what drives the dwell-time problem. A dormant implant generates no activity to correlate against, so the window between the initial compromise and the first triggered command can stretch across weeks or months of log retention you may no longer hold. When you eventually find the DLL, you will be reconstructing an intrusion from evidence that has already aged out of your SIEM.

The listener makes the exposure wider than the single infected host. It captures everything crossing every watched interface, including traffic addressed to other machines, so a gateway, a VPN concentrator or a host bridging two network segments can receive a trigger intended for a different system entirely. In flat or partially segmented networks, that means one implanted server gives an operator a listening position over neighboring traffic.

The command language itself explains what the operator can do once the packet lands. The 23 instructions cover scheduling, several methods of moving data, staged file delivery verified against a SHA-256 hash before execution, and running code directly in memory. Nothing in the instruction set writes to disk, which limits the forensic artifacts your responders will recover and makes it harder to prove what was taken.

Six transports carry that traffic, and two of them create specific blind spots for how most organizations monitor:

• VMware VMCI moves data through the virtualization layer instead of a network adapter, so a capture taken between two virtual machines misses the exchange completely.
• SMB named pipes with credentialed lateral movement let the operator use valid accounts to reach other hosts, producing authentication events that look like ordinary administrative activity.
• Raw promiscuous capture, TCP, UDP and ICMP give the operator several fallback channels if you filter one of them.

The named-pipe channel comes with a configuration change that affects hosts beyond this malware. SLEEPWALKER sets the EveryoneIncludesAnonymous registry value and appends its pipe name to NullSessionPipes, which allows unauthenticated callers to reach the pipe. Its cleanup routine tracks only whether its own write succeeded, so a removal attempt can delete a legitimate entry that predates the infection and break an application that depended on it.

For regulated environments, the compliance question is not whether the backdoor exfiltrated data but whether you can demonstrate it did not. In-memory execution with no disk writes leaves thin evidence, and HIPAA breach determinations, PCI-DSS cardholder data environment scoping and SOC 2 audit responses all rest on documenting what an intruder could reach. If the implanted host had visibility into segments carrying protected health information or cardholder data, your assessors will treat that access as in scope.

Because side-loading is the only persistence mechanism and relies on Windows DLL search order rather than a software flaw, a confirmed match resolves to incident response and a rebuild of the affected host. Budget for the staff hours, the service outage during rebuild, and the credential rotation that follows any host where credentialed lateral movement was available.

Detection and Forensic Indicators for SLEEPWALKER and Related Tools

The file-level indicators are the only reliable starting point, because the sample carries no network infrastructure to pivot on. Reichel published a SHA-256 of d347170752a28e2b8c4b8b9f3cab2e3a6541ba11682c94498d26eb9002779d60 and an MD5 of 2318327b29bb1c0e2d2b5f0211fc7fac, alongside a second filename to hunt for in the same directory as the agent executable: an unexpected dpapisvc.dll. Hash matching only catches this build, so a hunt that stops at the hash will miss a recompile.

The registry artifacts are more durable but noisier. The backdoor sets EveryoneIncludesAnonymous to 1 and appends its pipe name to NullSessionPipes so unauthenticated callers can reach its named-pipe channel. Both values exist for legitimate reasons in some environments, and Reichel is explicit that they carry weight only when compared against a known-good baseline.

One detail matters for anyone doing post-incident forensics on those keys. The cleanup routine records whether its own write to NullSessionPipes succeeded, not whether an entry was already there. A removal can therefore delete a legitimate pipe entry that predates the infection, which means the registry state you find after an operator cleans up is not a trustworthy reconstruction of the pre-compromise configuration.

Behavioral telemetry is where the implant is most visible, because several of its capabilities are unusual for a management agent process:

• An interface placed in promiscuous mode by the agent process, capturing all traffic crossing it, including frames addressed to other hosts
• Named-pipe creation and credentialed SMB connections outbound from the agent process for lateral movement
• ICMP and raw socket activity attributed to a process that has no legitimate reason to open one
• VMCI socket use, which passes through the virtualization layer and never touches a network adapter

The VMCI transport is the one that defeats conventional packet capture outright. A capture placed between two virtual machines sees nothing, because the traffic never reaches a virtual NIC. Guest-side process and socket telemetry becomes the only record of that channel.

Memory forensics matters more than disk forensics here. No instruction in the 23-instruction language writes to disk, so staged payloads (verified against a SHA-256 hash before execution) and in-memory code execution leave no dropped file to recover. The embedded configuration decrypts with AES-256-CCM into a single instruction, and commands arrive as bytecode in a format that exists only inside this binary, so extracting the key gives you opcodes with no external reference to compare them against.

Two opcodes handle triggering. The analyzed build enables the raw-packet listener, while a DNS-based trigger is implemented in the binary and left inactive. Anyone writing DNS-side detection logic should treat that path as present in the code and possible in a future build.

Reichel's writeup ships a YARA rule and a read-only PowerShell scanner that checks the published indicators across an estate. He noted that the YARA rule keys partly on a static AES key and on compiled protocol code, both of which a rebuild with different compiler settings could break. He also said detection coverage for the file was low at publication, without stating a basis for that figure. As of August 26, The Hacker News found no public release of the analysis toolkit or mitigation guide described in the post on his site or GitHub profile.

There is no C2 infrastructure to block and no beacon interval to profile. Detection rests on host artifacts, process behavior, and memory, and a match means incident response and a rebuild rather than a signature update.

Immediate and Prioritized Response Actions

Capture memory before you touch anything else. SLEEPWALKER executes code directly in memory and no instruction in its 23-instruction set writes to disk, so a reboot or a shutdown during triage destroys most of what an investigator would use to reconstruct what the operator ran. Take a full memory image of the suspect host first, then pull it off the network.

In the first 24 hours, work through the hosts that can see the most traffic. The raw listener captures everything crossing each watched interface, including packets addressed to other machines, so a gateway, a VPN concentrator, or any host bridging two segments is both the highest-value place for an operator to plant the DLL and the place a trigger meant for a neighbouring machine can land.

• Inventory every system running the ESET Management Agent and check each one, not a sample.
• Widen the file hunt past the agent directory. The backdoor validates only the host process name, not its signature or path, so any directory where a process with that name can start is in scope.
• List network adapters in promiscuous mode on servers that have no packet-capture or monitoring role.
• Snapshot the current values of the two registry keys on clean hosts so you have a known-good baseline to compare against.

If you confirm a match, treat the host as a rebuild. There is no patch, because the side-loading uses normal Windows DLL search order, and the implant reloads every time the agent service restarts. Do not let the malware's own cleanup routine run during remediation, since it records whether its own write to NullSessionPipes succeeded and can delete a legitimate entry that predates the infection. Edit that value by hand against your baseline.

Over the following week, push the published YARA rule and the read-only PowerShell scanner across the estate, then treat both as a floor rather than a verdict. The rule keys partly on a static AES key and on compiled protocol code, so a rebuild with different compiler settings can break it. Pair it with behavioural hunting across the six transports the language supports:

• Named-pipe connections from accounts that have no business authenticating to that server, which is how the credentialed lateral movement path shows up in logs.
• ICMP and UDP sessions to hosts that normally speak only TCP.
• VMCI traffic between ESXi hosts and guests, which passes through the virtualization layer and never reaches a network adapter, so your span-port captures will not contain it.
• Evidence of a separate dropper, since anything the backdoor expects to find on disk had to be written by another component.

Writing the DLL into place needs local administrator rights the operator already held, so review privileged credential use on the affected host for the period covered by your log retention. In environments Capstone manages, SentinelOne flags unsigned DLLs loading into security-agent processes and in-memory execution of delivered payloads, which is the behaviour this implant depends on once the trigger packet arrives.

For the longer term, enforce code signing and application control on the directories where management agents run, so an unsigned 59,904-byte DLL cannot load beside the executable it impersonates. Restrict anonymous named-pipe access through Group Policy instead of leaving it to per-host defaults, and segment gateway and VPN hosts so they are not passing foreign traffic past a listener. Set your incident response trigger at the first confirmed file or baseline mismatch, not at the first sign of outbound traffic, because this implant produces none.

Key Takeaway and Recommended First Action

The core risk with SLEEPWALKER is that its operator holds a general-purpose execution engine on your host, not a fixed set of hardcoded functions. The 23 instructions cover scheduling, several methods of moving data, staged file delivery that the implant verifies against a SHA-256 hash before running it, and in-memory code execution. What the operator sends next is a design decision made after the fact, so your exposure is not bounded by what the sample does today.

Those commands ride six transports: TCP, UDP, ICMP, SMB named pipes with credentialed lateral movement, raw promiscuous capture, and VMware's Virtual Machine Communication Interface. VMCI traffic crosses the virtualization layer instead of a network adapter, so if you run the agent inside guest virtual machines, a capture placed between two hosts records nothing of that channel. Your visibility gap sits below the layer most network monitoring watches.

There is also a second trigger already compiled into the binary. A DNS-based activation opcode exists in the code and is simply not enabled in this build, which means a rebuild can change how activation looks without changing what the implant can do.

The one action worth taking before anything else is inventory. Establish which of your hosts run ESET Management Agent, then confirm that the only dpapi.dll those processes load is the genuine copy in C:\Windows\System32. Any copy sitting in the agent's own directory is a finding that calls for full incident response and a rebuild, because the side-loading uses Windows DLL search order and there is no vendor patch to apply.

ESET had issued no advisory or public statement on the sample as of August 26. Track the vendor's advisory channel for any telemetry confirmation.