SLEEPWALKER Windows backdoor reverse engineering with YARA and PowerShell detection
Technical Analysis
Summary
Hide ▲
Show ▼
Researchers documented SLEEPWALKER, a previously unreported Windows backdoor that stays inert until a crafted packet arrives, expanding the set of stealthy post-compromise implants defenders need to hunt. The DLL is built to side-load into ERAAgent.exe, impersonates dpapi.dll, and avoids embedded infrastructure or outbound beacons. The analysis also releases a YARA rule and a read-only PowerShell scanner to find host indicators such as EveryoneIncludesAnonymous, NullSessionPipes, and the sample hashes.
Related Happenings
SynkLoader Microsoft Teams help-desk phishing campaign
Campaign
H score35
First: 21.08.2026 21:01
Last: 21.08.2026 21:01
Sources 1
About this happening:
The SynkLoader campaign is using Microsoft Teams help-desk impersonation and a fake PowerShell Cleaner MSI to push victims into a credential-theft chain that can open...
SynkLoader Microsoft Teams help-desk phishing campaign
CampaignAbout this happening: The SynkLoader campaign is using Microsoft Teams help-desk impersonation and a fake PowerShell Cleaner MSI to push victims into a credential-theft chain that can open...
NightLedger, BridgeHead, and ArcBridge covert-access deployment
Malware Activity
H score23
First: 28.07.2026 14:55
Last: 28.07.2026 14:55
Sources 1
About this happening:
The NightLedger, BridgeHead, and ArcBridge toolkit has been deployed in active intrusions to preserve covert access and tunnel operator traffic through victim syst...
NightLedger, BridgeHead, and ArcBridge covert-access deployment
Malware ActivityAbout this happening: The NightLedger, BridgeHead, and ArcBridge toolkit has been deployed in active intrusions to preserve covert access and tunnel operator traffic through victim syst...
SprySOCKS Windows backdoor activity against government organizations
Malware Activity
H score23
First: 16.06.2026 12:00
Last: 16.06.2026 12:00
Sources 1
About this happening:
SprySOCKS now has documented Windows variants, WIN_DRV and WIN_PLUS, expanding a toolset first known as a Linux-only backdoor. The activity is tied to govern...
SprySOCKS Windows backdoor activity against government organizations
Malware ActivityAbout this happening: SprySOCKS now has documented Windows variants, WIN_DRV and WIN_PLUS, expanding a toolset first known as a Linux-only backdoor. The activity is tied to govern...
GPU cryptomining malware using ScreenConnect and SEO poisoning
Malware Activity
H score16
First: 28.05.2026 00:31
Last: 28.05.2026 00:31
Sources 1
About this happening:
A cryptojacking malware operation is spreading through SEO-poisoned download pages and, in some cases, AI chatbot recommendations, putting high-performance Windows s...
GPU cryptomining malware using ScreenConnect and SEO poisoning
Malware ActivityAbout this happening: A cryptojacking malware operation is spreading through SEO-poisoned download pages and, in some cases, AI chatbot recommendations, putting high-performance Windows s...
MuddyWater Microsoft Teams social-engineering campaign with Chaos ransomware decoy
Campaign
H score37
First: 06.05.2026 16:02
Last: 06.05.2026 16:02
Sources 1
About this happening:
The MuddyWater campaign used Microsoft Teams social engineering and a Chaos ransomware decoy to gain access, steal credentials, and establish persistence. The operatio...
MuddyWater Microsoft Teams social-engineering campaign with Chaos ransomware decoy
CampaignAbout this happening: The MuddyWater campaign used Microsoft Teams social engineering and a Chaos ransomware decoy to gain access, steal credentials, and establish persistence. The operatio...
Timeline
-
26.08.2026 10:12 2 articles · 2h ago
SLEEPWALKER Windows backdoor is documented with packet-triggered bytecode execution
Initial DisclosureIndependent malware researcher documented SLEEPWALKER, a previously unreported Windows backdoor that waits for a crafted network packet and then executes a custom 23-instruction bytecode language. The unsigned 64-bit Windows DLL is built for side-loading into ERAAgent.exe for ESET Management Agent, impersonates Microsoft's dpapi.dll, and the writeup released a YARA rule and read-only PowerShell scanner for hunting host indicators such as unexpected dpapi.dll and dpapisvc.dll files, EveryoneIncludesAnonymous set to 1, and an unexpected NullSessionPipes entry.
Show sources
- Newly SLEEPWALKER Backdoor Waits for One Crafted Packet, Then Runs Its Own Bytecode — thehackernews.com — 26.08.2026 10:12
- Newly SLEEPWALKER Backdoor Waits for One Crafted Packet, Then Runs Its Own Bytecode — thehackernews.com — 26.08.2026 10:12