SLEEPWALKER: Passive-Trigger Windows Backdoor Masquerading as dpapi.dll via ERAAgent.exe Side-Loading

SLEEPWALKER: Passive-Trigger Windows Backdoor Masquerading (TL-2026-2166) is a medium-severity malware campaign, first published 2026-08-27. It has no confirmed attribution, affects ESET ESET Management Agent (ERAAgent.exe), maps to 13 MITRE ATT&CK techniques (T1005, T1021, T1027), and is covered by 9 detection rules and 10 indicators of compromise.

Key facts for TL-2026-2166

Threat ID
TL-2026-2166
Severity
MEDIUM
Status
ACTIVE
Category
MALWARE
First published
2026-08-27
Last reviewed
2026-08-27
Motivation
UNKNOWN
Detection rules
9
Indicators of compromise
10

Malware and tooling in SLEEPWALKER: Passive-Trigger Windows Backdoor Masquerading

Malware and tooling: SLEEPWALKER, mbedTLS

Researcher Dominik Reichel (R136a1) disclosed SLEEPWALKER, a previously undocumented Windows backdoor that masquerades as Microsoft's dpapi.dll and is side-loaded by ESET Management Agent's ERAAgent.exe. Instead of beaconing to a C2 server, it puts the network interface into promiscuous mode and passively waits for an AES-256-CCM-encrypted magic packet, activating only after confirming its host process is ERAAgent.exe.

How SLEEPWALKER: Passive-Trigger Windows Backdoor Masquerading works

SLEEPWALKER is an unsigned, 64-bit Windows DLL (59,904 bytes, SHA-256 d347170752a28e2b8c4b8b9f3cab2e3a6541ba11682c94498d26eb9002779d60) built to be dropped alongside ERAAgent.exe, the executable for ESET's Management Agent (ESET PROTECT/ERA), and loaded via DLL side-loading -- its only persistence mechanism. It masquerades as Microsoft's genuine dpapi.dll, exporting the same seven DPAPI functions (CryptProtectDataNoUI, CryptProtectMemory, CryptResetMachineCredentials, CryptUnprotectDataNoUI, CryptUnprotectMemory, CryptUpdateProtectedState, iCryptIdentifyProtection) as forwarding stubs to a non-existent dpapisvc.dll, and it carries a forged ESET Management Agent PE version resource (v11.2.2076.0) to pass casual inspection. The PE compile timestamp is 2024-06-10 09:18:27 UTC.

After loading, the malware validates that its host process is named ERAAgent.exe via runtime string reconstruction (not a hardcoded literal) before doing anything else -- a check that both confirms the intended deployment context and frustrates sandbox/analysis execution. It then places the network interface into promiscuous mode and passively inspects all traffic traversing the host, looking for a 'magic packet': candidate packets must be at least 48 bytes, pass an XOR-and-0xAAAA-derived length check, a byte-pair sum validation, and a CRC-32 check before the malware attempts an AES-256-CCM decryption (16-byte MAC tag) using a key and bootstrap nonce embedded in the sample. A parallel DNS-based trigger (present in the sample but not enabled at analysis time) carries the same AES-256-CCM envelope Base32-encoded inside DNS query labels, with a CRC-8 (polynomial 0x31) checksum splitting markers into the 'g'-'v' character range.

Decrypted payloads are bytecode programs for a proprietary 23-instruction command language (opcodes documented by the researcher from 0x06 through 0x88) covering process control (EXIT, SPAWN_THREAD_SCRIPT), scheduling/jitter (SLEEP_SECONDS, SLEEP_RANDOM_SECONDS, CRON_SCHEDULE, REPEAT_N, LOOP_FOREVER), outbound/inbound transport over TCP, UDP, ICMP, and named pipes, staged payload assembly with SHA-256 verification (STAGE_WRITE/STAGE_VERIFY_EXEC), LZMA-compressed payload execution (DECOMPRESS_RUN), and in-memory shellcode execution (RUN_SHELLCODE, which allocates writable memory, flips it executable via VirtualProtect, and runs attacker-supplied machine code inside the ERAAgent.exe process). The malware also supports VMware Virtual Machine Communication Interface (VMCI) channels for guest-to-host and guest-to-guest command transport, and for lateral movement it can enable unauthenticated SMB access by setting EveryoneIncludesAnonymous to 1 and adding an entry to NullSessionPipes, then creating named pipes with Everyone/Anonymous Logon full-control permissions. All cryptographic operations use a statically linked copy of mbedTLS rather than Windows CNG/CryptoAPI.

Because the backdoor never initiates outbound C2 traffic on its own, network-based detections built around known-bad domains/IPs will not observe it; defenders instead need endpoint indicators (an unexpected dpapi.dll/dpapisvc.dll pair beside ERAAgent.exe, the registry/named-pipe changes) and network sensors capable of recognizing the documented magic-packet framing pattern. No confirmed victims, delivery/initial-access vector, or threat-actor attribution have been established; the researcher characterizes the design as 'consistent with a targeted, well-resourced operation rather than an opportunistic one.' This is a distinct technique/target from the unrelated, already-patched ESET DLL search-order-hijacking flaw CVE-2024-11859 (ecls.exe / version.dll, exploited by ToddyCat and patched in January 2025) -- SLEEPWALKER targets ERAAgent.exe/dpapi.dll and no vendor advisory or CVE has been issued for it.

MITRE ATT&CK techniques used in TL-2026-2166

Collection

T1005 Data from Local System

Lateral Movement

T1021 Remote Services

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information; T1574 Hijack Execution Flow; T1620 Reflective Code Loading

Command and Control

T1071 Application Layer Protocol; T1095 Non-Application Layer Protocol; T1205 Traffic Signaling; T1571 Non-Standard Port

Execution

T1106 Native API

defense-impairment

T1112 Modify Registry

Affected products and versions in SLEEPWALKER: Passive-Trigger Windows Backdoor Masquerading

  • ESET — ESET Management Agent (ERAAgent.exe)
    Vulnerable versions: Any deployment where a writable ERAAgent.exe directory allows planting of a same-named dpapi.dll; forged version resource observed matches v11.2.2076.0

Remediation for SLEEPWALKER: Passive-Trigger Windows Backdoor Masquerading

Patches

  • No CVE or vendor patch has been issued specifically for SLEEPWALKER's ERAAgent.exe/dpapi.dll side-loading vector as of publication (2026-08-27)

Immediate actions

  • On hosts running ESET Management Agent, check the ERAAgent.exe installation directory for an unexpected dpapi.dll (compare against SHA-256 d347170752a28e2b8c4b8b9f3cab2e3a6541ba11682c94498d26eb9002779d60) and an unexpected dpapisvc.dll in the same directory
  • Check HKLM:\SYSTEM\CurrentControlSet\Control\Lsa for EveryoneIncludesAnonymous set to 1, and HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters\NullSessionPipes for unexpected pipe entries
  • Inventory named pipes granting Everyone or Anonymous Logon full-control access
  • Flag network interfaces running in promiscuous mode on hosts running ERAAgent.exe

Workarounds

  • Baseline and periodically re-verify the contents of the ERAAgent.exe directory after every ESET Management Agent update, since side-loading is SLEEPWALKER's only persistence mechanism

Longer-term hardening

  • Apply file-integrity monitoring to the ESET Management Agent installation directory to catch DLL planting
  • Restrict write access to the ERAAgent.exe directory to non-installer accounts
  • Deploy network sensors that can match the documented magic-packet framing pattern (minimum 48-byte length, XOR/0xAAAA length derivation, byte-pair sum check, CRC-32 validation) rather than relying solely on C2 domain/IP blocklists, since the backdoor never beacons out on its own

Weaknesses (CWE) in SLEEPWALKER: Passive-Trigger Windows Backdoor Masquerading

CWE-427

Timeline of SLEEPWALKER: Passive-Trigger Windows Backdoor Masquerading

  • Analyzed SLEEPWALKER dpapi.dll sample built (PE compile timestamp 2024-06-10 09:18:27 UTC)
  • The Register covers the disclosure: 'You don't want this Sleepwalker backdoor on your Windows machine'
  • Dominik Reichel (R136a1) publicly documents SLEEPWALKER for the first time, publishing full technical analysis, bytecode decoder toolkit, and mitigation guide on r136a1.dev
  • Slashdot and propakistani.pk syndicate coverage of the SLEEPWALKER disclosure
  • The Hacker News publishes 'New SLEEPWALKER Backdoor Waits for One Crafted Packet, Then Runs Its Own Bytecode', reiterating IOCs and researcher quotes
  • GBHackers News publishes coverage of the SLEEPWALKER backdoor

Sources cited for SLEEPWALKER: Passive-Trigger Windows Backdoor Masquerading

More in malware

Detection coverage for TL-2026-2166

As of 2026-08-27, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2166 across Splunk SPL, Microsoft KQL and Sigma, covering 10 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats