New Backdoor Hides in ESET Agent, Activated by Network Packet

Key Takeaways

• A new Windows backdoor, dubbed SLEEPWALKER, has been identified, designed for stealthy operation within trusted processes.
• The malware utilizes DLL side-loading, specifically targeting the ESET Management Agent, to establish persistence.
• SLEEPWALKER remains dormant until activated by a precisely crafted network packet, making it difficult to detect through conventional network monitoring.
• It features a custom command language and can execute memory-resident code, stage data, and facilitate lateral movement.
• While no specific threat actor or victim has been linked, its sophistication suggests a targeted intrusion capability.

A sophisticated new Windows backdoor, named SLEEPWALKER, has been uncovered by security researchers, distinguished by its passive activation mechanism and stealthy operational methods. Unlike many common malware variants that phone home to command-and-control servers, SLEEPWALKER embeds itself within legitimate processes and awaits a specific network trigger before becoming active, thereby minimizing its network footprint and evading detection.

The malware gains initial access and persistence through a technique known as DLL side-loading. This involves placing a malicious Dynamic Link Library (DLL) file in a location where a trusted, legitimate application will inadvertently load it instead of its intended, benign counterpart. While DLL side-loading is not new, SLEEPWALKER enhances this tactic with a passive trigger and its own bespoke command language for subsequent operations.

Security analysts at R136a1 identified this malware following an in-depth examination of a seemingly innocuous sample. In a report, R136a1 indicated that current evidence does not link the code to any previously known threat group or specific victim. However, the advanced nature of the backdoor suggests a targeted attack methodology rather than a widespread, indiscriminate campaign.

Successful deployment of SLEEPWALKER typically requires the attacker to have already achieved a foothold within the victim’s network to place the malicious DLL alongside the targeted management agent. Once active, the backdoor can perform various malicious functions, including receiving tasks, exfiltrating data, and executing arbitrary code directly in memory.

Dissecting the SLEEPWALKER Backdoor

SLEEPWALKER is a 64-bit Windows library designed to impersonate a legitimate component of the ESET Management Agent. Upon the agent’s startup, the malicious library performs a quick check to verify the host process name. If the check is successful, it initiates a worker thread, decrypts its initial instructions, and begins silently monitoring network traffic across all available interfaces.

A key characteristic distinguishing SLEEPWALKER is its complete lack of overt network activity during its dormant phase. It neither opens a visible listening port nor transmits any initial beacon, a stark contrast to many other in-memory backdoors. This absence of typical network indicators allows the legitimate ESET Management Agent to continue its operations unimpeded, significantly complicating early incident response and detection efforts.

The backdoor’s activation mechanism relies on a highly specific network packet. This packet must satisfy several conditions, including precise length, checksums, and encryption parameters. Any deviation results in no response from the implant. A valid, decrypted packet is then processed by a compact, built-in interpreter, which understands 23 distinct instructions for tasks like scheduling, staging, communication, and memory-only execution. The absence of hard-coded command servers, domains, or URLs in the analyzed sample further compounds detection challenges, as it eliminates common indicators of compromise related to suspicious outbound connections or domain lookups.

Advanced Command and Control Capabilities

Once activated by the secret network packet, SLEEPWALKER demonstrates a wide array of post-exploitation capabilities. It can receive subsequent commands via multiple protocols, including TCP, UDP, ICMP, SMB named pipes, raw packets, and even VMware’s VMCI channel. The inclusion of VMCI, which enables communication between virtual machines and their host without traversing physical network adapters, highlights the backdoor’s adaptability to virtualized environments and its sophisticated evasion techniques.

The malware also possesses a dormant DNS-based trigger capability, which was not enabled in the observed startup configuration. If activated, this feature would allow attackers to transmit encrypted instructions through specially formatted DNS queries, effectively bypassing network restrictions that typically permit DNS traffic while blocking other protocols. This makes the monitoring of unusual DNS patterns a critical defensive measure.

SLEEPWALKER’s post-trigger functionalities significantly escalate the risk to compromised systems. It can stage memory-resident code, cryptographically verify its integrity, and execute it without ever writing a payload to disk, making forensic analysis exceptionally difficult. Furthermore, it can create named pipes and leverage supplied credentials to communicate with other systems on the network, opening avenues for lateral movement and broader compromise.

To facilitate anonymous named-pipe access, the implant temporarily modifies local Windows security settings, specifically by setting EveryoneIncludesAnonymous = 1 and adding unexpected entries to NullSessionPipes. While the malware attempts to revert these changes, there’s a risk that the cleanup process might unintentionally remove legitimate, pre-existing settings. These modifications require administrator privileges, indicating that the backdoor itself does not include an privilege escalation component.

What You Should Do

• Monitor for DLL Side-Loading: Implement robust monitoring for unexpected DLLs being loaded from the directories of legitimate management agents, such as the ESET Management Agent.
• Validate File Integrity: Regularly verify the cryptographic hashes and digital signatures of critical system files and installed software components to detect unauthorized modifications.
• Review Registry Settings: Audit Windows registry values related to anonymous SMB and named-pipe access (e.g., EveryoneIncludesAnonymous and NullSessionPipes) and compare them against established, known-good baselines.
• Enhance Network Monitoring: Deploy advanced network monitoring solutions capable of raw-packet capture and deep packet inspection to detect unusual traffic patterns that might indicate a SLEEPWALKER activation or command.
• Monitor Process-Side Library Loads: Utilize Endpoint Detection and Response (EDR) solutions to monitor for suspicious library loads within legitimate processes.
• Implement IoC Scanning: Utilize the provided Indicators of Compromise (IoCs) to scan your environment for the presence of SLEEPWALKER. R136a1 has released a detection rule and a PowerShell scanner for this purpose.

Indicators of Compromise (IoCs)

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.