Published on September 1, 2026
New Windows Backdoor Stays Completely Silent Until Hackers Send a Secret Trigger
Severity
High
Detail
Security researchers at PolySwarm have identified a newly discovered Windows backdoor named SLEEPWALKER, designed to remain dormant on compromised systems until it receives a specially crafted network packet from an operator. SLEEPWALKER does not require routine outbound beaconing. Instead, it places available network interfaces into promiscuous mode and continuously monitors for traffic matching a specific encrypted packet format.
The malware is an unsigned 64-bit Windows library designed to operate alongside a legitimate security-management component. It can be introduced through DLL side-loading, allowing malicious code to execute from a trusted-looking management-agent process.
PolySwarm reported that there is currently no identified threat actor, victim, campaign, delivery chain, or confirmed evidence that the analyzed sample was used in a live intrusion. However, the backdoor’s stealthy architecture and broad command capabilities create significant detection and incident-response concerns for enterprise environments.
How?
SLEEPWALKER operates by abusing DLL side-loading techniques to execute malicious code under the context of a legitimate management-agent process. The malware impersonates a trusted DLL file named dpapi[.]dll and is intended to be loaded alongside the legitimate ERAAgent[.]exe process.
Instead of connecting to a hard-coded C2 server, SLEEPWALKER places available network interfaces into promiscuous mode and passively monitors network traffic for a specially crafted packet. The trigger packet must satisfy validation checks, including framing verification and CRC-32 integrity checks, before the embedded payload is decrypted using AES-256-CCM encryption.
Following successful decryption, the malware processes the received instructions through a proprietary bytecode interpreter. Researchers identified support for 23 bytecode instructions capable of performing tasks such as scheduling operations, creating additional listeners, executing payloads directly in memory, and establishing alternative communication channels.
The malware can also modify Windows settings to enable anonymous access to named pipes, facilitating covert local communications. During analysis, PolySwarm observed that only the raw-packet listener functionality was enabled, while additional capabilities such as DNS-based tasking, VMware VMCI communications, lateral movement functions, and staged payload delivery remained dormant within the code. Due to its passive architecture, SLEEPWALKER generates minimal network artifacts and does not require continuous communication with attacker-controlled infrastructure, allowing it to remain undetected for extended periods while awaiting activation.
Indicator of Compromises (IoCs)
The table below shows a selection of indicators of compromise (IoCs) associated with SLEEPWALKER activity.
| Type | Indicator | Description |
| SHA-256 | d347170752a28e2b8c4b8b9f3cab2e3a6541ba11682c94498d26eb9002779d60 | SLEEPWALKER malware sample |
| File Name | dpapi[.]dll | Unsigned malicious DLL masquerading as a legitimate Microsoft component |
| Process Name | ERAAgent[.]exe | Management-agent process targeted for DLL side-loading |
Conclusion
SLEEPWALKER demonstrates how modern malware can evade traditional detection mechanisms by eliminating routine command-and-control communications and remaining inactive until explicitly triggered. Its use of DLL side-loading, encrypted network-based activation, and in-memory execution techniques significantly reduces observable indicators of compromise.
The malware’s ability to operate through trusted processes, support multiple covert communication methods, and execute commands without maintaining persistent outbound connections highlights the growing trend toward stealth-focused malware design. Organizations should strengthen behavioral monitoring, validate DLL integrity within trusted applications, monitor for unexpected promiscuous-mode network activity, and investigate unauthorized named-pipe or security-configuration changes to improve detection of similar threats.
Source