SLEEPWALKER, the backdoor that implants itself in the ESET agent and listens for a "magic packet"

On August 26, 2026, independent researcher Dominik Reichel documented SLEEPWALKER, a Windows backdoor not previously described publicly. The analyzed sample is an unsigned 64-bit DLL of 59,904 bytes, designed to be loaded in place of the Microsoft system library dpapi.dll during the startup of ERAAgent.exe, the ESET Management Agent executable. The DLL exports the same seven data protection functions as the original library and includes a version resource copied from the ESET agent. It contains no domains, IP addresses, or URLs, and does not make autonomous outbound connections: a choice that evades traffic monitoring to known infrastructure.

A post-compromise implant, not an entry vector

SLEEPWALKER exploits the Windows DLL search order, not a vulnerability in ESET software. The operator must already have local administrator privileges on the target machine: the backdoor is a post-compromise implant, not a way to gain initial access. Persistence is ensured by the side-loading itself: the DLL is reloaded every time the ESET Management Agent service starts. SLEEPWALKER checks only the host process name, not the digital signature or the full path, which makes the implant relatively simple to install but also fragile if the legitimate file is replaced.

There is no applicable patch: since this is not an ESET vulnerability, the response is incident response. The vendor has not issued advisories or public statements as of August 26, 2026.

Encrypted commands and a "magic packet" trigger

Commands intended for the backdoor do not arrive as readable text but as bytecode. Decryption with AES-256-CCM produces opcodes of a proprietary language comprising 23 instructions. The configuration embedded in the sample, once decrypted, reduces to a single instruction: listen indefinitely on every network interface waiting for a specific packet, called a "magic packet".

The listener captures all traffic in transit, including that destined for other machines. This allows gateways, VPN servers, or jump hosts to detect triggers that are not intended for them. The six available transports for communication are TCP, UDP, ICMP, SMB named pipes with lateral movement via credentials, raw promiscuous capture, and VMware Virtual Machine Communication Interface (VMCI). VMCI traffic travels through the virtualization layer and does not appear in packet captures between two physical machines: a capability that makes the channel particularly suitable for virtualized infrastructures.

Two instructions implement the trigger mechanism. In the analyzed sample, only the raw-packet listener is active; a second opcode, based on DNS, is present in the binary but is not active in this build.

Operational capabilities and impact

The 23 instructions of the proprietary language support scheduling, data movement, multi-stage file delivery with SHA-256 verification, and direct in-memory code execution. No instruction writes to disk: the necessary files must be dropped by a separate component. This further reduces the forensic footprint.

For lateral movement via SMB named pipes, SLEEPWALKER sets the registry value EveryoneIncludesAnonymous to 1 and adds the pipe name to NullSessionPipes, enabling unauthenticated access. The cleanup routine logs only the success of its own write, without checking whether legitimate entries already existed: during removal it may delete pre-existing configurations and cause malfunctions.

The overall impact is high for stealth and in-memory execution capabilities, but the threat remains limited to systems already compromised with administrative privileges. There are no associated CVEs: the discovery concerns a malicious implant, not a security flaw in third-party software.

Indicators of compromise and mitigations

Reichel has published the following host indicators for detection:

• Unexpected dpapi.dll in the same directory as ERAAgent.exe
• Unexpected dpapisvc.dll in the same directory
• SHA-256: d347170752a28e2b8c4b8b9f3cab2e3a6541ba11682c94498d26eb9002779d60
• MD5: 2318327b29bb1c0e2d2b5f0211fc7fac
• EveryoneIncludesAnonymous set to 1
• Unexpected entry in NullSessionPipes

The registry values should be compared against a known baseline, because they may be legitimately used by other services in particular environments. The writeup includes a YARA rule based partially on a static AES key and on compiled code, and a read-only PowerShell scanner to verify the indicators. As of August 26, 2026, the analysis toolkit and mitigation guide had not yet been published on Reichel's website or GitHub; anyone who suspects being targeted is encouraged to contact him directly.

Since there is no patch, recommended actions are checking the indicators, isolating suspicious systems, and conducting a thorough analysis of network and system logs to identify any anomalous packets or registry modifications.

Context and precedents

Reichel has not attributed SLEEPWALKER to a known actor. Collection context is missing: no information is available about the victim, sector, or country. The researcher considers the approach consistent with a targeted and well-funded operation.

The use of side-loading against ESET is not new. In the past, according to Kaspersky, the ToddyCat group exploited a flaw in the search order of the ESET command-line scanner. The use of VMCI sockets for persistence also has precedents: Mandiant documented them in intrusions attributed to UNC3886. On Linux, implants with similar "magic packet" triggers have been observed with BPFDoor, attributed to Red Menshen and documented by Rapid7. SLEEPWALKER brings this technique to Windows, combining side-loading, encrypted bytecode, and promiscuous capture in a single implant.