Malware

Sleepwalker

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

10 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

2 techniques

T1059Command and Scripting InterpreterEvidence2

This passive backdoor employs its own 23-instruction language for operations ranging from code execution to data exfiltration.

T1559.001Component Object ModelEvidence1

Another one writes a block of data to a Windows named pipe on a chosen computer, and can optionally log in with a username and password first... Five other instructions focus on inbound task reception... creating and/or connecting to a named pipe.

Stealth

3 techniques

T1027.013Encrypted/Encoded FileEvidence1

The commands are encrypted using AES-256-CCM and are delivered as raw bytes, requiring reverse engineering of the custom language.

T1036MasqueradingEvidence1

The malware, hidden inside a 64-bit Windows DLL file, impersonates Microsoft's dpapi.dll, part of Windows' data protection API for protecting sensitive data. It exports the same seven functions as the real dpapi.dll... The file also has a forged ESET Management Agent version resource

T1620Reflective Code LoadingEvidence1

The commands can do everything from running code directly in memory to moving data off the computer.

Credential Access

1 technique

T1040Network SniffingEvidence2

Unlike typical backdoors that connect to a command-and-control server, Sleepwalker passively scans network traffic for a "magic packet." Once detected, it decrypts and executes commands.

Discovery

1 technique

T1040Network SniffingEvidence2

Unlike typical backdoors that connect to a command-and-control server, Sleepwalker passively scans network traffic for a "magic packet." Once detected, it decrypts and executes commands.

Command and Control

3 techniques

T1105Ingress Tool TransferEvidence1

Its 23 instructions cover scheduling, several ways to move data, staged file delivery and running code directly in memory... Five other instructions focus on inbound task reception, such as waiting to receive - or reaching out on its own - a follow-up instruction

T1572Protocol TunnelingEvidence1

the remote host can be a VMware VMCI target instead of a normal network address... opens a TCP connection to a chosen address and port, and then sends a block of data to a remote host, which can be a VMware VMCI target instead of a normal network address.

T1573Encrypted ChannelEvidence1

Every command sent to the backdoor is encrypted using AES-256-CCM

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence2

This passive backdoor employs its own 23-instruction language for operations ranging from code execution to data exfiltration.

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

scworldNews

Aug 25, 2026

New ‘Sleepwalker’ backdoor uses custom command language | brief | SC Media

A passive Windows backdoor that impersonates Microsoft's dpapi.dll and side-loads into ESET Management Agent. Rather than beaconing to C2, it monitors network traffic for a magic packet, then decrypts and executes AES-256-CCM-encrypted commands using its own 23-instruction custom language. It supports operations including code execution and data exfiltration, and can also target VMware VMCI.

Aug 24, 2026

You don't want this Sleepwalker backdoor on your Windows machine

A previously unseen Windows backdoor hidden in a 64-bit DLL that impersonates dpapi.dll and side-loads via ERAAgent.exe. It remains dormant in memory, passively sniffing for a magic packet, then decrypts and executes a custom 23-instruction bytecode command language. It supports in-memory code execution, staged file delivery, data exfiltration, TCP/UDP and named-pipe communications, and can use VMware VMCI targets instead of normal network addresses.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping10

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

Sleepwalker

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

10 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

2 techniques

T1059Command and Scripting InterpreterEvidence2

This passive backdoor employs its own 23-instruction language for operations ranging from code execution to data exfiltration.

T1559.001Component Object ModelEvidence1

Stealth

3 techniques

T1027.013Encrypted/Encoded FileEvidence1

The commands are encrypted using AES-256-CCM and are delivered as raw bytes, requiring reverse engineering of the custom language.

T1036MasqueradingEvidence1

T1620Reflective Code LoadingEvidence1

The commands can do everything from running code directly in memory to moving data off the computer.

Credential Access

1 technique

T1040Network SniffingEvidence2

Unlike typical backdoors that connect to a command-and-control server, Sleepwalker passively scans network traffic for a "magic packet." Once detected, it decrypts and executes commands.

Discovery

1 technique

T1040Network SniffingEvidence2

Unlike typical backdoors that connect to a command-and-control server, Sleepwalker passively scans network traffic for a "magic packet." Once detected, it decrypts and executes commands.

Command and Control

3 techniques

T1105Ingress Tool TransferEvidence1

T1572Protocol TunnelingEvidence1

T1573Encrypted ChannelEvidence1

Every command sent to the backdoor is encrypted using AES-256-CCM

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence2

This passive backdoor employs its own 23-instruction language for operations ranging from code execution to data exfiltration.

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

scworldNews

Aug 25, 2026

New ‘Sleepwalker’ backdoor uses custom command language | brief | SC Media

Aug 24, 2026

You don't want this Sleepwalker backdoor on your Windows machine

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping10

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.