SLEEPWALKER: Passive-Trigger Windows Backdoor Masquerading as dpapi.dll via ERAAgent.exe Side-Loading

Key facts for SLEEPWALKER passive backdoor

Detection coverage for SLEEPWALKER passive backdoor

As of 2026-08-27, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2166 across Splunk SPL, Microsoft KQL and Sigma, covering 10 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: SLEEPWALKER Post-Exploitation — Anonymous SMB Staging & In-Process Shellcode — SPL

Detects SLEEPWALKER's lateral-movement staging on a compromised ERAAgent.exe host: setting EveryoneIncludesAnonymous to 1, adding an entry to NullSessionPipes, creating a named pipe with Everyone/Anonymous-Logon full-control ACLs, and its RUN_SHELLCODE bytecode instruction allocating writable memory and flipping it executable (VirtualProtect) to run attacker-supplied machine code inside the ERAAgent.exe process.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1112, T1021, T1620, T1106
• Data sources: sysmon (registry, pipe creation, process access), microsoft_defender_for_endpoint (DeviceRegistryEvents, DeviceEvents)
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational"
| eval is_reg_mod=if(EventCode=13 AND (TargetObject="*\\Control\\Lsa\\EveryoneIncludesAnonymous" OR TargetObject="*\\LanmanServer\\Parameters\\NullSessionPipes"), 1, 0)
| eval is_pipe=if(EventCode=17 OR EventCode=18, 1, 0)
| eval is_mem_access=if(EventCode=10 AND match(GrantedAccess, "0x1F(0FFF|3FFF)"), 1, 0)
| where (is_reg_mod=1 OR is_pipe=1 OR is_mem_access=1) AND (Image="*\\ERAAgent.exe" OR SourceImage="*\\ERAAgent.exe")
| table _time, host, EventCode, Image, SourceImage, TargetImage, TargetObject, Details, PipeName, GrantedAccess
| sort -_time

Microsoft KQL

let RegMods = DeviceRegistryEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "ERAAgent.exe"
| where (RegistryKey has @"Control\Lsa" and RegistryValueName == "EveryoneIncludesAnonymous")
    or (RegistryKey has @"LanmanServer\Parameters" and RegistryValueName == "NullSessionPipes")
| project Timestamp, DeviceName, InitiatingProcessFileName, RegistryKey, RegistryValueName, RegistryValueData;
let PipeAndMem = DeviceEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "ERAAgent.exe"
| where ActionType in ("NamedPipeEvent", "ProcessMemoryProtectionModified", "ReflectiveDllLoad")
| project Timestamp, DeviceName, InitiatingProcessFileName, ActionType, AdditionalFields;
RegMods
| union PipeAndMem
| sort by Timestamp desc

Sigma

title: SLEEPWALKER Post-Exploitation — Anonymous SMB Staging and In-Process Shellcode from ERAAgent.exe
id: b2c3d4e5-f6a7-4b8c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects SLEEPWALKER's lateral-movement staging (EveryoneIncludesAnonymous/NullSessionPipes registry changes, Everyone/Anonymous-ACL named pipe creation) and its RUN_SHELLCODE in-memory execution originating from the ERAAgent.exe process.
references:
  - https://r136a1.dev/2026/08/24/sleepwalker-a-passive-backdoor-with-its-own-command-language/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/08/27
tags:
  - attack.defense-evasion
  - attack.lateral-movement
  - attack.execution
  - attack.t1112
  - attack.t1021
  - attack.t1620
  - attack.t1106
  - attack.tool.sleepwalker
logsource:
  category: registry_set
  product: windows
detection:
  selection_reg_anon:
    TargetObject|endswith: '\Control\Lsa\EveryoneIncludesAnonymous'
    Details: '0x1'
  selection_reg_pipe:
    TargetObject|endswith: '\LanmanServer\Parameters\NullSessionPipes'
  selection_parent:
    Image|endswith: '\ERAAgent.exe'
  condition: selection_parent and (selection_reg_anon or selection_reg_pipe)
falsepositives:
  - Legitimate group policy or sysadmin script hardening/relaxing NullSessionPipes during a scheduled maintenance window
level: high

Known false positives:

• Legitimate group policy or sysadmin script relaxing NullSessionPipes/EveryoneIncludesAnonymous during a scheduled compatibility change
• Security tools or debuggers legitimately requesting broad PROCESS_VM_WRITE/PROCESS_VM_OPERATION access to ERAAgent.exe for AV scanning

Tuning notes: Correlate the registry change with the same-host named-pipe creation and memory-protection events within a short window (minutes) rather than alerting on the registry write alone, to suppress isolated legitimate NullSessionPipes administration; tune the GrantedAccess mask to the specific PAGE_EXECUTE_READWRITE-granting bitmask observed in the ERAAgent.exe process on your EDR.

• 🔒 SLEEPWALKER [indicator] Side-Loading via ERAAgent.exe — KQL · unlock with TL Creds
• 🔒 SLEEPWALKER Post-Exploitation — Anonymous SMB Staging & In-Process Shellcode — KQL · unlock with TL Creds
• 🔒 SLEEPWALKER Magic-Packet / DNS Activation Trigger Candidate — KQL · unlock with TL Creds
• 🔒 SLEEPWALKER [indicator] Side-Loading via ERAAgent.exe — Sigma · unlock with TL Creds
• 🔒 SLEEPWALKER Post-Exploitation — Anonymous SMB Staging & In-Process Shellcode — Sigma · unlock with TL Creds
• 🔒 SLEEPWALKER Magic-Packet / DNS Activation Trigger Candidate — Sigma · unlock with TL Creds
• 🔒 SLEEPWALKER [indicator] Side-Loading via ERAAgent.exe — SPL · unlock with TL Creds
• 🔒 SLEEPWALKER Magic-Packet / DNS Activation Trigger Candidate — SPL · unlock with TL Creds

Indicators of compromise for SLEEPWALKER passive backdoor

As of 2026-08-27, Threadlinqs Intelligence tracks 10 indicators of compromise for TL-2026-2166.

Sample indicators (3 of 10)

• File hash: d347170752a28e2b8c4b8b9f3cab2e3a6541ba11682c94498d26eb9002779d60
• File hash: 2318327b29bb1c0e2d2b5f0211fc7fac
• File hash: 2ec8aa9661a33bccc002150ce1ed02d90c3986ff

Defanged, TLP:CLEAR. Full set of 10 indicators: unlock with TL Creds.

How SLEEPWALKER passive backdoor works

SLEEPWALKER is an unsigned, 64-bit Windows DLL (59,904 bytes, SHA-256 d347170752a28e2b8c4b8b9f3cab2e3a6541ba11682c94498d26eb9002779d60) built to be dropped alongside ERAAgent.exe, the executable for ESET's Management Agent (ESET PROTECT/ERA), and loaded via DLL side-loading -- its only persistence mechanism. It masquerades as Microsoft's genuine dpapi.dll, exporting the same seven DPAPI functions (CryptProtectDataNoUI, CryptProtectMemory, CryptResetMachineCredentials, CryptUnprotectDataNoUI, CryptUnprotectMemory, CryptUpdateProtectedState, iCryptIdentifyProtection) as forwarding stubs to a non-existent dpapisvc.dll, and it carries a forged ESET Management Agent PE version resource (v11.2.2076.0) to pass casual inspection. The PE compile timestamp is 2024-06-10 09:18:27 UTC.

After loading, the malware validates that its host process is named ERAAgent.exe via runtime string reconstruction (not a hardcoded literal) before doing anything else -- a check that both confirms the intended deployment context and frustrates sandbox/analysis execution. It then places the network interface into promiscuous mode and passively inspects all traffic traversing the host, looking for a 'magic packet': candidate packets must be at least 48 bytes, pass an XOR-and-0xAAAA-derived length check, a byte-pair sum validation, and a CRC-32 check before the malware attempts an AES-256-CCM decryption (16-byte MAC tag) using a key and bootstrap nonce embedded in the sample. A parallel DNS-based trigger (present in the sample but not enabled at analysis time) carries the same AES-256-CCM envelope Base32-encoded inside DNS query labels, with a CRC-8 (polynomial 0x31) checksum splitting markers into the 'g'-'v' character range.

Decrypted payloads are bytecode programs for a proprietary 23-instruction command language (opcodes documented by the researcher from 0x06 through 0x88) covering process control (EXIT, SPAWN_THREAD_SCRIPT), scheduling/jitter (SLEEP_SECONDS, SLEEP_RANDOM_SECONDS, CRON_SCHEDULE, REPEAT_N, LOOP_FOREVER), outbound/inbound transport over TCP, UDP, ICMP, and named pipes, staged payload assembly with SHA-256 verification (STAGE_WRITE/STAGE_VERIFY_EXEC), LZMA-compressed payload execution (DECOMPRESS_RUN), and in-memory shellcode execution (RUN_SHELLCODE, which allocates writable memory, flips it executable via VirtualProtect, and runs attacker-supplied machine code inside the ERAAgent.exe process). The malware also supports VMware Virtual Machine Communication Interface (VMCI) channels for guest-to-host and guest-to-guest command transport, and for lateral movement it can enable unauthenticated SMB access by setting EveryoneIncludesAnonymous to 1 and adding an entry to NullSessionPipes, then creating named pipes with Everyone/Anonymous Logon full-control permissions. All cryptographic operations use a statically linked copy of mbedTLS rather than Windows CNG/CryptoAPI.

Because the backdoor never initiates outbound C2 traffic on its own, network-based detections built around known-bad domains/IPs will not observe it; defenders instead need endpoint indicators (an unexpected dpapi.dll/dpapisvc.dll pair beside ERAAgent.exe, the registry/named-pipe changes) and network sensors capable of recognizing the documented magic-packet framing pattern. No confirmed victims, delivery/initial-access vector, or threat-actor attribution have been established; the researcher characterizes the design as 'consistent with a targeted, well-resourced operation rather than an opportunistic one.' This is a distinct technique/target from the unrelated, already-patched ESET DLL search-order-hijacking flaw CVE-2024-11859 (ecls.exe / version.dll, exploited by ToddyCat and patched in January 2025) -- SLEEPWALKER targets ERAAgent.exe/dpapi.dll and no vendor advisory or CVE has been issued for it.

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System

Lateral Movement

T1021 Remote Services

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information; T1574 Hijack Execution Flow; T1620 Reflective Code Loading

Command and Control

T1071 Application Layer Protocol; T1095 Non-Application Layer Protocol; T1205 Traffic Signaling; T1571 Non-Standard Port

Execution

T1106 Native API

defense-impairment

T1112 Modify Registry

Remediation for SLEEPWALKER passive backdoor

Patches

• No CVE or vendor patch has been issued specifically for SLEEPWALKER's ERAAgent.exe/dpapi.dll side-loading vector as of publication (2026-08-27)

Immediate actions

• On hosts running ESET Management Agent, check the ERAAgent.exe installation directory for an unexpected dpapi.dll (compare against SHA-256 d347170752a28e2b8c4b8b9f3cab2e3a6541ba11682c94498d26eb9002779d60) and an unexpected dpapisvc.dll in the same directory
• Check HKLM:\SYSTEM\CurrentControlSet\Control\Lsa for EveryoneIncludesAnonymous set to 1, and HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters\NullSessionPipes for unexpected pipe entries
• Inventory named pipes granting Everyone or Anonymous Logon full-control access
• Flag network interfaces running in promiscuous mode on hosts running ERAAgent.exe

Workarounds

• Baseline and periodically re-verify the contents of the ERAAgent.exe directory after every ESET Management Agent update, since side-loading is SLEEPWALKER's only persistence mechanism

Longer-term hardening

• Apply file-integrity monitoring to the ESET Management Agent installation directory to catch DLL planting
• Restrict write access to the ERAAgent.exe directory to non-installer accounts
• Deploy network sensors that can match the documented magic-packet framing pattern (minimum 48-byte length, XOR/0xAAAA length derivation, byte-pair sum check, CRC-32 validation) rather than relying solely on C2 domain/IP blocklists, since the backdoor never beacons out on its own

Affected and fixed versions

• ESET — ESET Management Agent (ERAAgent.exe)
  Vulnerable versions: Any deployment where a writable ERAAgent.exe directory allows planting of a same-named dpapi.dll; forged version resource observed matches v11.2.2076.0

Timeline of SLEEPWALKER passive backdoor

• 2024-06-10 Analyzed locked-ioc-8 locked-ioc-9 sample built (PE compile timestamp 2024-06-10 09:18:27 UTC)
• 2026-08-24 The Register covers the disclosure: 'You don't want this locked-ioc-8 backdoor on your Windows machine'
• 2026-08-24 Dominik Reichel (R136a1) publicly documents locked-ioc-8 for the first time, publishing full technical analysis, bytecode decoder toolkit, and mitigation guide on r136a1.dev
• 2026-08-25 Slashdot and propakistani.pk syndicate coverage of the locked-ioc-8 disclosure
• 2026-08-26 The Hacker News publishes 'New locked-ioc-8 Backdoor Waits for One Crafted Packet, Then Runs Its Own Bytecode', reiterating IOCs and researcher quotes
• 2026-08-27 GBHackers News publishes coverage of the locked-ioc-8 backdoor

Sources cited for SLEEPWALKER passive backdoor

• [CA8810] DLL Search Order Hijacking Vulnerability in ESET products for Windows fixed support.eset.com · Advisory · 2025-04-04
• SLEEPWALKER: A Passive Backdoor With Its Own Command Language r136a1.dev · Research · 2026-08-24
• R136a1 original disclosure thread x.com · Research · 2026-08-24
• ToddyCat APT exploits a vulnerability in ESET for DLL proxying Kaspersky Securelist · Research · 2025-04-07
• New SLEEPWALKER Backdoor Masquerades as dpapi.dll to Evade Detection gbhackers.com · Blog · 2026-08-27
• New SLEEPWALKER Backdoor Waits for One Crafted Packet, Then Runs Its Own Bytecode The Hacker News · News · 2026-08-26
• You don't want this Sleepwalker backdoor on your Windows machine The Register · News · 2026-08-24
• Sleepwalker Windows backdoor hides until network trigger cybernews.com · News · 2026-08-24
• New Windows Backdoor Can Hide Silently Until Hackers Activate It propakistani.pk · News · 2026-08-25
• Windows Backdoor 'Sleepwalker' Hides in Memory Until Activated by a 'Magic Packet' it.slashdot.org · News · 2026-08-25

Threats related to SLEEPWALKER passive backdoor

• VoidLink Linux Rootkit Framework — eBPF + LKM Hybrid Persistence with ICMP C2
• Daxin Returns: China-Linked Kernel Rootkit Resurfaces in Taiwan Alongside New Stupig Backdoor