SLEEPWALKER: Passive-Trigger Windows Backdoor Masquerading as dpapi.dll via ERAAgent.exe Side-Loading — Threadlinqs Intelligence
As of 2026-08-27, SLEEPWALKER: Passive-Trigger Windows Backdoor Masquerading as dpapi.dll via ERAAgent.exe Side-Loading is a medium-severity malware threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 10 indicators of compromise.
Threat ID: TL-2026-2166 · Severity: MEDIUM · Status: ACTIVE · Category: MALWARE
Researcher Dominik Reichel (R136a1) disclosed SLEEPWALKER, a previously undocumented Windows backdoor that masquerades as Microsoft's dpapi.dll and is side-loaded by ESET Management Agent's
SLEEPWALKER is an unsigned, 64-bit Windows DLL (59,904 bytes, SHA-256 d347170752a28e2b8c4b8b9f3cab2e3a6541ba11682c94498d26eb9002779d60) built to be dropped alongside ERAAgent.exe, the executable for ESET's Management Agent (ESET PROTECT/ERA), and loaded via DLL side-loading -- its only persistence mechanism. It masquerades as Microsoft's genuine dpapi.dll, exporting the same seven DPAPI functions (CryptProtectDataNoUI, CryptProtectMemory, CryptResetMachineCredentials, CryptUnprotectDataNoUI, CryptUnprotectMemory, CryptUpdateProtectedState, iCryptIdentifyProtection) as forwarding stubs to a non-existent dpapisvc.dll, and it carries a forged ESET Management Agent PE version resource (v11.2.2076.0) to pass casual inspection. The PE compile timestamp is 2024-06-10 09:18:27 UTC.
After loading, the malware validates that its host process is named ERAAgent.exe via runtime string reconstruction (not a hardcoded literal) before doing anything else -- a check that both confirms the intended deployment context and frustrates sandbox/analysis execution. It then places the network interface into promiscuous mode and passively inspects all traffic traversing the host, looking for a 'magic packet': candidate packets must be at least 48 bytes, pass an XOR-and-0xAAAA-derived length check, a byte-pair sum validation, and a CRC-32 check before the malware attempts an AES-256-CCM decryption (16-byte MAC tag) using a key and bootstrap nonce embedded in the sample. A parallel DNS-based trigger (present in the sample but not enabled at analysis time) carries the same AES-256-CCM envelope Base32-encoded inside DNS query labels, with a CRC-8 (polynomial 0x31) checksum splitting markers into the 'g'-'v' character range.
Decrypted payloads are bytecode programs for a proprietary 23-instruction command language (opcodes documented by the researcher from 0x06 through 0x88) covering process control (EXIT, SPAWN_THREAD_SCRIPT), scheduling/jitter (SLEEP_SECONDS, SLEEP_RANDOM_SECONDS, CRON_SCHEDULE, REPEAT_N, LOOP_FOREVER), outbound/inbound transport over TCP, UDP, ICMP, and named pipes, staged payload assembly with SHA-256 verification (STAGE_WRITE/STAGE_VERIFY_EXEC), LZMA-compressed payload execution (DECOMPRESS_RUN), and in-memory shellcode execution (RUN_SHELLCODE, which allocates writable memory, flips it executable via VirtualProtect, and runs attacker-supplied machine code inside the ERAAgent.exe process). The malware also supports VMware Virtual Machine Communication Interface (VMCI) channels for guest-to-host and guest-to-guest command transport, and for lateral movement it can enable unauthenticated SMB access by setting EveryoneIncludesAnonymous to 1 and adding an entry to NullSessionPipes, then creating named pipes with Everyone/Anonymous Logon full-control permissions. All cryptographic operations use a statically linked copy of mbedTLS rather than Windows CNG/CryptoAPI.
Because the backdoor never initiates outbound C2 traffic on its own, network-based detections built around known-bad domains/IPs will not observe it; defenders instead need endpoint indicators (an unexpected dpapi.dll/dpapisvc.dll pair beside ERAAgent.exe, the registry/named-pipe changes) and network sensors capable of recognizing the documented magic-packet framing pattern. No confirmed victims, delivery/initial-access vector, or threat-actor attribution have been established; the researcher characterizes the design as 'consistent with a targeted, well-resourced operation rather than an opportunistic one.' This is a distinct technique/target from the unrelated, already-patched ESET DLL search-order-hijacking flaw CVE-2024-11859 (ecls.exe / version.dll, exploited by ToddyCat and patched in January 2025) -- SLEEPWALKER targets ERAAgent.exe/dpapi.dll and no vendor advisory or CVE has been issued for it.
Timeline
- Analyzed SLEEPWALKER dpapi.dll sample built (PE compile timestamp 2024-06-10 09:18:27 UTC)
- Dominik Reichel (R136a1) publicly documents SLEEPWALKER for the first time, publishing full technical analysis, bytecode decoder toolkit, and mitigation guide on r136a1.dev
- The Register covers the disclosure: 'You don't want this Sleepwalker backdoor on your Windows machine'
- Slashdot and propakistani.pk syndicate coverage of the SLEEPWALKER disclosure
- The Hacker News publishes 'New SLEEPWALKER Backdoor Waits for One Crafted Packet, Then Runs Its Own Bytecode', reiterating IOCs and researcher quotes
- GBHackers News publishes coverage of the SLEEPWALKER backdoor
Detections & IOCs
As of 2026-09-06, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 10 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, MEDIUM, threat intelligence, cybersecurity, T1574, T1036, T1027, T1140, T1112, T1620, T1205, T1071, T1571, T1095
