Back Scworld

New 'Sleepwalker' backdoor uses custom command language | brief

Scworld • August 25, 2026

A previously unknown Windows backdoor, dubbed Sleepwalker, has been discovered lying dormant in system memory, awaiting a specific network packet to activate its commands. This passive backdoor employs its own 23-instruction language for operations ranging from code execution to data exfiltration, according to a recent report by The Register.

Discovered by malware researcher Dominik Reichel, Sleepwalker impersonates Microsoft's dpapi.dll and loads via side-loading into ESET Management Agent. Unlike typical backdoors that connect to a command-and-control server, Sleepwalker passively scans network traffic for a "magic packet." Once detected, it decrypts and executes commands written in its unique, 23-instruction language. The commands are encrypted using AES-256-CCM and are delivered as raw bytes, requiring reverse engineering of the custom language.

The backdoor can also target VMware VMCI, suggesting a sophisticated, targeted operation. While the exact victims, industry, or origin remain unknown due to a lack of collection context, Reichel has provided a toolkit for detection and mitigation.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

New Sleepwalker Backdoor Targets Windows Systems with Unique Command Language A newly discovered Windows backdoor named Sleepwalker has been detailed by malware researcher Dominik Reichel. This passive backdoor remains dormant in memory until it receives a specifically crafted network packet, which activates its 23-instruction command language. Sleepwalker is embedded in a 64-bit Windows DLL that impersonates Microsoft's dpapi.dll and is designed to be side-loaded into the ESET Management Agent's executable, ERAAgent.exe. The malware does not open any listening ports or contact a command-and-control server, making it difficult for traditional security tools to detect. It can execute a variety of tasks, including running code in memory and moving data off the infected machine. The backdoor uses AES-256-CCM for encryption, and its unique command language requires reverse engineering for full understanding. Currently, there are no reports of active exploitation, but its design suggests it could be part of a targeted operation. 5 sources 51

Extracted Entities

New 'Sleepwalker' backdoor uses custom command language | brief

The full story

Extracted Entities

Attack Types (1)

Malware (1)

MITRE ATT&CK (1)

Platforms (1)

Tools (2)