SLEEPWALKER Windows backdoor reverse engineering with YARA and PowerShell detection
Technical Analysis
Summary
Hide ▲
Show ▼
Researchers documented SLEEPWALKER, a previously unreported Windows backdoor that stays inert until a crafted packet arrives, expanding the set of stealthy post-compromise implants defenders need to hunt. The DLL is built to side-load into ERAAgent.exe, impersonates dpapi.dll, and avoids embedded infrastructure or outbound beacons. The analysis also releases a YARA rule and a read-only PowerShell scanner to find host indicators such as EveryoneIncludesAnonymous, NullSessionPipes, and the sample hashes.
Related Happenings
SynkLoader Microsoft Teams help-desk phishing campaign
Campaign
H score35
First: 21.08.2026 21:01
Last: 21.08.2026 21:01
Sources 1
About this happening:
The SynkLoader campaign is using Microsoft Teams help-desk impersonation and a fake PowerShell Cleaner MSI to push victims into a credential-theft chain that can open...
SynkLoader Microsoft Teams help-desk phishing campaign
CampaignAbout this happening: The SynkLoader campaign is using Microsoft Teams help-desk impersonation and a fake PowerShell Cleaner MSI to push victims into a credential-theft chain that can open...
NightLedger, BridgeHead, and ArcBridge covert-access deployment
Malware Activity
H score23
First: 28.07.2026 14:55
Last: 28.07.2026 14:55
Sources 1
About this happening:
Nimbus Manticore has expanded its covert-access malware set with NightLedger, BridgeHead, and ArcBridge in intrusions across the Middle East, Africa, and Sou...
NightLedger, BridgeHead, and ArcBridge covert-access deployment
Malware ActivityAbout this happening: Nimbus Manticore has expanded its covert-access malware set with NightLedger, BridgeHead, and ArcBridge in intrusions across the Middle East, Africa, and Sou...
Latest development: 26.08.2026 18:35
Group-IB found additional Tortoiseshell infrastructure spanning Europe and the Middle East, including a reverse SSH tunneling tool that masquerades as the Windows Terminal Server SDK API and connects to 172.86.98[.]113 on port 443, plus a C++ backdoor that mimics wtsapi32.dll and uses hard-coded C2 servers to download and upload files, execute binaries or DLLs, gather host information, list directories, and delete files.
SprySOCKS Windows backdoor activity against government organizations
Malware Activity
H score23
First: 16.06.2026 12:00
Last: 16.06.2026 12:00
Sources 1
About this happening:
SprySOCKS now has documented Windows variants, WIN_DRV and WIN_PLUS, expanding a toolset first known as a Linux-only backdoor. The activity is tied to govern...
SprySOCKS Windows backdoor activity against government organizations
Malware ActivityAbout this happening: SprySOCKS now has documented Windows variants, WIN_DRV and WIN_PLUS, expanding a toolset first known as a Linux-only backdoor. The activity is tied to govern...
GPU cryptomining malware using ScreenConnect and SEO poisoning
Malware Activity
H score16
First: 28.05.2026 00:31
Last: 28.05.2026 00:31
Sources 1
About this happening:
A cryptojacking malware operation is spreading through SEO-poisoned download pages and, in some cases, AI chatbot recommendations, putting high-performance Windows s...
GPU cryptomining malware using ScreenConnect and SEO poisoning
Malware ActivityAbout this happening: A cryptojacking malware operation is spreading through SEO-poisoned download pages and, in some cases, AI chatbot recommendations, putting high-performance Windows s...
MuddyWater Microsoft Teams social-engineering campaign with Chaos ransomware decoy
Campaign
H score37
First: 06.05.2026 16:02
Last: 06.05.2026 16:02
Sources 1
About this happening:
The MuddyWater campaign used Microsoft Teams social engineering and a Chaos ransomware decoy to gain access, steal credentials, and establish persistence. The operatio...
MuddyWater Microsoft Teams social-engineering campaign with Chaos ransomware decoy
CampaignAbout this happening: The MuddyWater campaign used Microsoft Teams social engineering and a Chaos ransomware decoy to gain access, steal credentials, and establish persistence. The operatio...
Timeline
-
26.08.2026 10:12 2 articles · 13d ago
SLEEPWALKER Windows backdoor is documented with packet-triggered bytecode execution
Initial DisclosureIndependent malware researcher documented SLEEPWALKER, a previously unreported Windows backdoor that waits for a crafted network packet and then executes a custom 23-instruction bytecode language. The unsigned 64-bit Windows DLL is built for side-loading into ERAAgent.exe for ESET Management Agent, impersonates Microsoft's dpapi.dll, and the writeup released a YARA rule and read-only PowerShell scanner for hunting host indicators such as unexpected dpapi.dll and dpapisvc.dll files, EveryoneIncludesAnonymous set to 1, and an unexpected NullSessionPipes entry.
Show sources
- Newly SLEEPWALKER Backdoor Waits for One Crafted Packet, Then Runs Its Own Bytecode — thehackernews.com — 26.08.2026 10:12
- Newly SLEEPWALKER Backdoor Waits for One Crafted Packet, Then Runs Its Own Bytecode — thehackernews.com — 26.08.2026 10:12