[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fl0xX1Psua83fjwA5FgzV3ei4hrUUmuUmvaTHumJUgLs":3},{"article":4,"iocs":48,"watch_terms":62,"solutions":63,"lesson":164},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"e8a0678d-63f6-44e6-bf0d-1180d38c5459","Newly SLEEPWALKER Backdoor Waits for One Crafted Packet, Then Runs Its Own Bytecode","newly-sleepwalker-backdoor-waits-for-one-crafted-packet-then-runs-its-own-byteco-60e430","An independent malware researcher has documented a previously unreported Windows backdoor, dubbed SLEEPWALKER, that stays inert in memory until a specifically crafted network packet reaches the machine and then runs commands written in a 23-instruction language of its own design. The sample is an unsigned 64-bit Windows dynamic-link library (DLL) of 59,904 bytes, built to be side-loaded into&","A new Windows backdoor named SLEEPWALKER has been discovered that remains dormant in memory until it receives a specifically crafted network packet. Once triggered, it executes commands written in a custom 23-instruction language. The malware is designed to be side-loaded into ESET Management Agent and impersonates a legitimate DLL, making it difficult to detect through traditional network monitoring.","New SLEEPWALKER backdoor waits for a crafted packet to execute its own bytecode.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F08\u002Fnewly-sleepwalker-backdoor-waits-for.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEjSnbO35IDgg9dQouCuUCpAko8PiGwwI3lhn7I68m0Ok-PGL84lR1CU0sKk5rWfurFY7u1Fz-9U0-CXi1VCuAVpZDpKF3uDnvtyb062Kls6vW8L7xkTnZBPPJteihNrIWV3C__6JMphWMC7ER4_2bsgKDfzIuq5naTBB3pgZvKvD2v4djmpMh96F62y8Qg\u002Fs1600\u002Fsleepwalker.jpg","2026-08-26T07:12:55+00:00","2026-08-26T10:00:19.272299+00:00",8,[17,20,22,25,28],{"name":18,"type":19},"ERAAgent.exe","product",{"name":21,"type":19},"dpapi.dll",{"name":23,"type":24},"ESET","vendor",{"name":26,"type":27},"AES-256-CCM","technology",{"name":29,"type":27},"VMCI","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":30,"icon":32,"name":33,"slug":34},null,"Malware","malware",[36,38,43],{"category":37},{"id":30,"icon":32,"name":33,"slug":34},{"category":39},{"id":40,"icon":32,"name":41,"slug":42},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",{"category":44},{"id":45,"icon":32,"name":46,"slug":47},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[49,52,56,59],{"type":34,"value":50,"context":51},"SLEEPWALKER","Name of the newly discovered Windows backdoor",{"type":53,"value":54,"context":55},"mitre_attack","T1074","Implied by side-loading into ERAgent.exe and impersonating dpapi.dll",{"type":53,"value":57,"context":58},"T1059","Implied by the execution of custom bytecode commands",{"type":53,"value":60,"context":61},"T1105","Implied by staged file delivery verified against SHA-256 hash",[23,18,21],{"controls":64,"vendors":152},[65,94,123],{"slug":66,"name":67,"problem":68,"products":69},"application-allowlisting","Application allowlisting","Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.",[70,78,86],{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","app-control-for-business","App Control for Business","https:\u002F\u002Flearn.microsoft.com\u002Fen-us\u002Fwindows\u002Fsecurity\u002Fapplication-security\u002Fapplication-control\u002Fapp-control-for-business\u002F","Application control built into Windows, formerly Windows Defender Application Control, with AppLocker as the older option. Policies can be managed through Intune.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","allowlisting","Allowlisting","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fallowlisting","Blocks any software that has not been approved, including ransomware and unapproved remote-access tools. A learning period builds the approved list first.",{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"airlock-digital","Airlock Digital","\u002Fvendor-logos\u002Fairlock-digital.png","airlock-allowlisting","Airlock Allowlisting and Execution Control","https:\u002F\u002Fwww.airlockdigital.com\u002F","Blocks anything not explicitly trusted from running, with tools to build and keep the trusted list current as software changes.",{"slug":95,"name":96,"problem":97,"products":98},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[99,107,115],{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"slug":124,"name":125,"problem":126,"products":127},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[128,136,144],{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",{"vendor_slug":137,"vendor_name":138,"vendor_logo":139,"product_slug":140,"product_name":141,"url":142,"description":143},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",{"vendor_slug":145,"vendor_name":146,"vendor_logo":147,"product_slug":148,"product_name":149,"url":150,"description":151},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",[153,158],{"slug":154,"name":23,"logo_path":155,"roles":156},"eset","\u002Fvendor-logos\u002Feset.png",[157],"affected",{"slug":159,"name":160,"logo_path":161,"roles":162},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png",[163],"reported_by",{"slug":165,"title":166,"body":167,"framework_refs":168,"framework_notes":180},"sleepwalker-backdoor-hides-in-legitimate-software-via-dll-side-loading","SLEEPWALKER Backdoor Hides in Legitimate Software via DLL Side-Loading","SLEEPWALKER exploits DLL side-loading by masquerading as a legitimate library within ESET Management Agent, allowing it to persist undetected in memory until a single crafted network packet activates it. Its custom 23-instruction bytecode language bypasses signature-based detection tools that rely on known malware patterns. This attack highlights the danger of trusting processes solely because they appear to originate from legitimate software. The ability to remain dormant and blend into trusted agent traffic makes it particularly stealthy against traditional network monitoring. Organizations that lack deep application integrity verification and robust network behavioral analysis are especially vulnerable to this class of threat.",[169,170,171,172,173,174,175,176,177,178,179],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 10: Malware Defenses","CIS Control 13: Network Monitoring and Defense","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 CM-7: Least Functionality","NIST SP 800-53 SC-7: Boundary Protection","NIST SP 800-53 AU-12: Audit Record Generation","NIST Cybersecurity Framework DE.CM-1: Network Monitoring","NIST Cybersecurity Framework PR.DS-6: Integrity Checking","MITRE ATT&CK T1574.002: DLL Side-Loading","MITRE ATT&CK T1205: Traffic Signaling (Port Knocking)",{}]