An independent malware researcher recently unveiled SLEEPWALKER, a Windows backdoor that remains dormant until a specially crafted network packet is received. This backdoor executes commands using a unique 23-instruction language, making it a sophisticated threat in the realm of cybersecurity.
Technical Functionality and Deployment
The SLEEPWALKER backdoor is an unsigned 64-bit Windows DLL, designed to be side-loaded into the ESET Management Agent executable, ERAAgent.exe. It masquerades as Microsoft’s dpapi.dll, offering identical data protection functions to the legitimate library. With no embedded domains or IP addresses, this malware can evade detection by tools that monitor for suspicious network connections.
Commands sent to SLEEPWALKER appear as bytecode, which can only be interpreted within the malware itself. Dominik Reichel, a former malware researcher with Palo Alto Networks, highlights that this method reflects a targeted and well-financed operation. However, the lack of context around the sample makes it difficult to attribute it to a specific threat actor or victim.
Operation and Persistence
The backdoor utilizes AES-256-CCM encryption to monitor network interfaces for the trigger packet. This unique approach allows it to capture network traffic, even that intended for other machines, if deployed on a gateway or VPN server. SLEEPWALKER’s persistence is tied to the ESET Management Agent; it reloads each time the service starts, relying on the Windows DLL search order for side-loading, not an ESET software flaw.
Importantly, SLEEPWALKER acts as a post-compromise tool, requiring prior access to the target machine by an operator who must place the DLL in the desired directory with administrative rights. This dependency highlights the sophistication and targeted nature of its deployment.
Impact and Industry Response
The backdoor incorporates a range of functionalities, including data scheduling, file delivery, and code execution, all while avoiding disk writes. Notably, it utilizes six communication protocols, including VMCI, which allows it to bypass traditional network monitoring. As of now, ESET has not released any public statements or advisories regarding this threat.
Reichel has provided host indicators such as unexpected dpapi.dll files and registry modifications for detection. Despite limited public detection tools, a YARA rule and PowerShell scanner have been released by Reichel to assist organizations in identifying potentially compromised systems. However, these indicators are only effective against known baselines.
While SLEEPWALKER’s full impact and reach remain unclear, its sophisticated design and deployment strategy underscore the evolving threat landscape in cybersecurity. Organizations are advised to remain vigilant and consider reaching out to experts if they suspect exposure to this backdoor.
