# SLEEPWALKER: Passive-Trigger Windows Backdoor Masquerading as dpapi.dll via ERAAgent.exe Side-Loading

> Researcher Dominik Reichel (R136a1) disclosed SLEEPWALKER, a previously undocumented Windows backdoor that masquerades as Microsoft's dpapi.dll and is side-loaded by ESET Management Agent's ERAAgent.exe. Instead of beaconing to a C2 server, it puts the network interface into promiscuous mode and passively waits for an AES-256-CCM-encrypted magic packet, activating only after confirming its host process is ERAAgent.exe.

- **Published:** 2026-08-27T00:00:00Z
- **Last reviewed:** 2026-08-27T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2166
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-sleepwalker-passive-backdoor-tl-2026-2166.webp?v=6ef4bd59 (Threadlinqs threat intel: SLEEPWALKER Magic Packet Backdoor: Detection & IOCs (TL-2026-2166) — Medium severity, 10 IOCs, 9 detection rules.)
- **ID:** TL-2026-2166
- **Severity:** MEDIUM
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 10 (3 shown free below)

## Description

SLEEPWALKER is an unsigned, 64-bit Windows DLL (59,904 bytes, SHA-256 d347170752a28e2b8c4b8b9f3cab2e3a6541ba11682c94498d26eb9002779d60) built to be dropped alongside ERAAgent.exe, the executable for ESET's Management Agent (ESET PROTECT/ERA), and loaded via DLL side-loading -- its only persistence mechanism. It masquerades as Microsoft's genuine dpapi.dll, exporting the same seven DPAPI functions (CryptProtectDataNoUI, CryptProtectMemory, CryptResetMachineCredentials, CryptUnprotectDataNoUI, CryptUnprotectMemory, CryptUpdateProtectedState, iCryptIdentifyProtection) as forwarding stubs to a non-existent dpapisvc.dll, and it carries a forged ESET Management Agent PE version resource (v11.2.2076.0) to pass casual inspection. The PE compile timestamp is 2024-06-10 09:18:27 UTC.

After loading, the malware validates that its host process is named ERAAgent.exe via runtime string reconstruction (not a hardcoded literal) before doing anything else -- a check that both confirms the intended deployment context and frustrates sandbox/analysis execution. It then places the network interface into promiscuous mode and passively inspects all traffic traversing the host, looking for a 'magic packet': candidate packets must be at least 48 bytes, pass an XOR-and-0xAAAA-derived length check, a byte-pair sum validation, and a CRC-32 check before the malware attempts an AES-256-CCM decryption (16-byte MAC tag) using a key and bootstrap nonce embedded in the sample. A parallel DNS-based trigger (present in the sample but not enabled at analysis time) carries the same AES-256-CCM envelope Base32-encoded inside DNS query labels, with a CRC-8 (polynomial 0x31) checksum splitting markers into the 'g'-'v' character range.

Decrypted payloads are bytecode programs for a proprietary 23-instruction command language (opcodes documented by the researcher from 0x06 through 0x88) covering process control (EXIT, SPAWN_THREAD_SCRIPT), scheduling/jitter (SLEEP_SECONDS, SLEEP_RANDOM_SECONDS, CRON_SCHEDULE, REPEAT_N, LOOP_FOREVER), outbound/inbound transport over TCP, UDP, ICMP, and named pipes, staged payload assembly with SHA-256 verification (STAGE_WRITE/STAGE_VERIFY_EXEC), LZMA-compressed payload execution (DECOMPRESS_RUN), and in-memory shellcode execution (RUN_SHELLCODE, which allocates writable memory, flips it executable via VirtualProtect, and runs attacker-supplied machine code inside the ERAAgent.exe process). The malware also supports VMware Virtual Machine Communication Interface (VMCI) channels for guest-to-host and guest-to-guest command transport, and for lateral movement it can enable unauthenticated SMB access by setting EveryoneIncludesAnonymous to 1 and adding an entry to NullSessionPipes, then creating named pipes with Everyone/Anonymous Logon full-control permissions. All cryptographic operations use a statically linked copy of mbedTLS rather than Windows CNG/CryptoAPI.

Because the backdoor never initiates outbound C2 traffic on its own, network-based detections built around known-bad domains/IPs will not observe it; defenders instead need endpoint indicators (an unexpected dpapi.dll/dpapisvc.dll pair beside ERAAgent.exe, the registry/named-pipe changes) and network sensors capable of recognizing the documented magic-packet framing pattern. No confirmed victims, delivery/initial-access vector, or threat-actor attribution have been established; the researcher characterizes the design as 'consistent with a targeted, well-resourced operation rather than an opportunistic one.' This is a distinct technique/target from the unrelated, already-patched ESET DLL search-order-hijacking flaw CVE-2024-11859 (ecls.exe / version.dll, exploited by ToddyCat and patched in January 2025) -- SLEEPWALKER targets ERAAgent.exe/dpapi.dll and no vendor advisory or CVE has been issued for it.

## MITRE ATT&CK

- T1574 Hijack Execution Flow
- T1036 Masquerading
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1112 Modify Registry
- T1620 Reflective Code Loading
- T1205 Traffic Signaling
- T1071 Application Layer Protocol
- T1571 Non-Standard Port
- T1095 Non-Application Layer Protocol
- T1021 Remote Services
- T1005 Data from Local System
- T1106 Native API

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**SLEEPWALKER Post-Exploitation — Anonymous SMB Staging & In-Process Shellcode — SPL** (`TL-2026-2166-SPL-002`)

Detects SLEEPWALKER's lateral-movement staging on a compromised ERAAgent.exe host: setting EveryoneIncludesAnonymous to 1, adding an entry to NullSessionPipes, creating a named pipe with Everyone/Anonymous-Logon full-control ACLs, and its RUN_SHELLCODE bytecode instruction allocating writable memory and flipping it executable (VirtualProtect) to run attacker-supplied machine code inside the ERAAgent.exe process.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1112, T1021, T1620, T1106
- **Data sources:** sysmon (registry, pipe creation, process access), microsoft_defender_for_endpoint (DeviceRegistryEvents, DeviceEvents)
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational"
| eval is_reg_mod=if(EventCode=13 AND (TargetObject="*\\Control\\Lsa\\EveryoneIncludesAnonymous" OR TargetObject="*\\LanmanServer\\Parameters\\NullSessionPipes"), 1, 0)
| eval is_pipe=if(EventCode=17 OR EventCode=18, 1, 0)
| eval is_mem_access=if(EventCode=10 AND match(GrantedAccess, "0x1F(0FFF|3FFF)"), 1, 0)
| where (is_reg_mod=1 OR is_pipe=1 OR is_mem_access=1) AND (Image="*\\ERAAgent.exe" OR SourceImage="*\\ERAAgent.exe")
| table _time, host, EventCode, Image, SourceImage, TargetImage, TargetObject, Details, PipeName, GrantedAccess
| sort -_time
```

### Microsoft KQL

```kql
let RegMods = DeviceRegistryEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "ERAAgent.exe"
| where (RegistryKey has @"Control\Lsa" and RegistryValueName == "EveryoneIncludesAnonymous")
    or (RegistryKey has @"LanmanServer\Parameters" and RegistryValueName == "NullSessionPipes")
| project Timestamp, DeviceName, InitiatingProcessFileName, RegistryKey, RegistryValueName, RegistryValueData;
let PipeAndMem = DeviceEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "ERAAgent.exe"
| where ActionType in ("NamedPipeEvent", "ProcessMemoryProtectionModified", "ReflectiveDllLoad")
| project Timestamp, DeviceName, InitiatingProcessFileName, ActionType, AdditionalFields;
RegMods
| union PipeAndMem
| sort by Timestamp desc
```

### Sigma

```yaml
title: SLEEPWALKER Post-Exploitation — Anonymous SMB Staging and In-Process Shellcode from ERAAgent.exe
id: b2c3d4e5-f6a7-4b8c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects SLEEPWALKER's lateral-movement staging (EveryoneIncludesAnonymous/NullSessionPipes registry changes, Everyone/Anonymous-ACL named pipe creation) and its RUN_SHELLCODE in-memory execution originating from the ERAAgent.exe process.
references:
  - https://r136a1.dev/2026/08/24/sleepwalker-a-passive-backdoor-with-its-own-command-language/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/08/27
tags:
  - attack.defense-evasion
  - attack.lateral-movement
  - attack.execution
  - attack.t1112
  - attack.t1021
  - attack.t1620
  - attack.t1106
  - attack.tool.sleepwalker
logsource:
  category: registry_set
  product: windows
detection:
  selection_reg_anon:
    TargetObject|endswith: '\Control\Lsa\EveryoneIncludesAnonymous'
    Details: '0x1'
  selection_reg_pipe:
    TargetObject|endswith: '\LanmanServer\Parameters\NullSessionPipes'
  selection_parent:
    Image|endswith: '\ERAAgent.exe'
  condition: selection_parent and (selection_reg_anon or selection_reg_pipe)
falsepositives:
  - Legitimate group policy or sysadmin script hardening/relaxing NullSessionPipes during a scheduled maintenance window
level: high
```

**Known false positives:**

- Legitimate group policy or sysadmin script relaxing NullSessionPipes/EveryoneIncludesAnonymous during a scheduled compatibility change
- Security tools or debuggers legitimately requesting broad PROCESS_VM_WRITE/PROCESS_VM_OPERATION access to ERAAgent.exe for AV scanning

**Tuning notes:** Correlate the registry change with the same-host named-pipe creation and memory-protection events within a short window (minutes) rather than alerting on the registry write alone, to suppress isolated legitimate NullSessionPipes administration; tune the GrantedAccess mask to the specific PAGE_EXECUTE_READWRITE-granting bitmask observed in the ERAAgent.exe process on your EDR.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- SLEEPWALKER [indicator] Side-Loading via ERAAgent.exe — KQL (locked: unlock with TL Creds)
- SLEEPWALKER Post-Exploitation — Anonymous SMB Staging & In-Process Shellcode — KQL (locked: unlock with TL Creds)
- SLEEPWALKER Magic-Packet / DNS Activation Trigger Candidate — KQL (locked: unlock with TL Creds)
- SLEEPWALKER [indicator] Side-Loading via ERAAgent.exe — Sigma (locked: unlock with TL Creds)
- SLEEPWALKER Post-Exploitation — Anonymous SMB Staging & In-Process Shellcode — Sigma (locked: unlock with TL Creds)
- SLEEPWALKER Magic-Packet / DNS Activation Trigger Candidate — Sigma (locked: unlock with TL Creds)
- SLEEPWALKER [indicator] Side-Loading via ERAAgent.exe — SPL (locked: unlock with TL Creds)
- SLEEPWALKER Magic-Packet / DNS Activation Trigger Candidate — SPL (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 10)

Defanged, TLP:CLEAR.

- File hash: `d347170752a28e2b8c4b8b9f3cab2e3a6541ba11682c94498d26eb9002779d60`
- File hash: `2318327b29bb1c0e2d2b5f0211fc7fac`
- File hash: `2ec8aa9661a33bccc002150ce1ed02d90c3986ff`

Full set of 10 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [SLEEPWALKER: A Passive Backdoor With Its Own Command Language](https://r136a1.dev/2026/08/24/sleepwalker-a-passive-backdoor-with-its-own-command-language/)
- [New SLEEPWALKER Backdoor Masquerades as dpapi.dll to Evade Detection](https://gbhackers.com/sleepwalker-backdoor/)
- [New SLEEPWALKER Backdoor Waits for One Crafted Packet, Then Runs Its Own Bytecode](https://thehackernews.com/2026/08/newly-sleepwalker-backdoor-waits-for.html)
- [You don't want this Sleepwalker backdoor on your Windows machine](https://www.theregister.com/security/2026/08/24/you-dont-want-this-sleepwalker-backdoor-on-your-windows-machine/5292021)
- [Sleepwalker Windows backdoor hides until network trigger](https://cybernews.com/security/windows-sleepwalking-backdoor/)
- [New Windows Backdoor Can Hide Silently Until Hackers Activate It](https://propakistani.pk/2026/08/25/new-windows-backdoor-can-hide-silently-until-hackers-activate-it/)
- [Windows Backdoor 'Sleepwalker' Hides in Memory Until Activated by a 'Magic Packet'](https://it.slashdot.org/story/26/08/25/062246/windows-backdoor-sleepwalker-hides-in-memory-until-activated-by-a-magic-packet)
- [R136a1 original disclosure thread](https://x.com/TheEnergyStory/status/2091801554634330574)
- [CA8810 DLL Search Order Hijacking Vulnerability in ESET products for Windows fixed](https://support.eset.com/en/ca8810-dll-search-order-hijacking-vulnerability-in-eset-products-for-windows-fixed)
- [ToddyCat APT exploits a vulnerability in ESET for DLL proxying](https://securelist.com/toddycat-apt-exploits-vulnerability-in-eset-software-for-dll-proxying/116086/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2166