Loading story…
Researchers have documented a previously unknown Windows backdoor dubbed Sleepwalker that stays dormant in memory until it receives a specially crafted network "magic packet," allowing it to avoid traditional command-and-control patterns. The malware impersonates Microsoft's dpapi.dll and is loaded through DLL side-loading with ESET's ERAAgent.exe/ESET Management Agent, then passively monitors network traffic for AES-256-CCM-encrypted tasking instead of beaconing outward. Analysis by malware researcher Dominik Reichel found that Sleepwalker uses a custom 23-instruction command language to decrypt and execute operator commands.
Once activated, Sleepwalker can execute code in memory, transfer or exfiltrate data, and receive staged payloads, with some functionality indicating it can also communicate through VMware VMCI targets. Researchers said the tradecraft points to a stealthy, well-resourced, and likely targeted operation, but no victim identities, affected sectors, intrusion timeline, or operator attribution have been confirmed. Reichel has also released a toolkit intended to help defenders detect and mitigate the implant.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
Reichel created and released a toolkit, mitigation guide, and remediation script to help defenders analyze, detect, and respond to Sleepwalker infections. The materials were published alongside reporting on the malware's capabilities.
Malware analyst Dominik Reichel identified a previously unseen Windows backdoor dubbed Sleepwalker and analyzed its behavior, including its passive memory-resident design, custom 23-instruction command language, and DLL side-loading via ESET Management Agent. He found no confirmed victim, intrusion context, or attribution tied to the sample.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
8 references tracked. Mallory keeps watching after this page renders.
xakep.ru
Open sourcecyberaccord.com
Open sourcecybersecuritynews.com
Open sourcecryptika.com
Open sourcethehackernews.com
Open sourcescworld.com
Open sourcetheregister.com
Open sourcer136a1.dev
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed two separate malware chains that rely on deeply layered staging, DLL sideloading, and trusted signed software to conceal execution. One campaign, dubbed **Eimeria**, starts from a `RAR5` archive containing the signed `dsclock.exe`, a malicious `zlibwapi.dll`, and an encrypted payload that decrypts into an IExpress package and then an AutoIt-based RunPE loader. The chain restores `ntdll.dll` to evade EDR hooks, decrypts later stages with `AES-128-CBC`, `RC4`, and `LZNT1`, hollows `explorer.exe`, `svchost.exe`, or `taskhostw.exe`, and injects a small .NET RAT that beacons over WebSocket to `94.26.90.139:3006`. It also sets persistence through a Run key and scheduled task and uses delays, sleep checks, and CPU and memory stress tests to frustrate analysis. A second intrusion set tied to **UAC-0184 / MB-0007** used Ukraine-themed lures and messenger delivery to target Ukrainian Defense Forces personnel, beginning with `LNK` files that called `bitsadmin` to fetch `HTA` content from `169.40.135.35` for execution via `mshta`. The downloaded archive abused legitimate Plane9 components for sideloading through `Cluster-Overlay64.exe`, `Plane9Engine.dll`, and `openvr_api.dll`, then decoded `kernel-diag.lib` into `evr.dll` and unpacked `filter.bin` by rebuilding `IDAT` chunks, XOR-decoding with key `0x227E9BDE`, and decompressing with `LZNT1`. The final bundle included signed utilities such as Microsoft-signed `VSLauncher.exe` and a renamed PassMark Endpoint DLL, indicating the actor likely repurposed a signed network stack and dump-capable tooling for covert internal communications, with controller details possibly discovered dynamically over multicast `224.0.0.255:31339` and TCP `31339` rather than a fixed external C2.
Jun 29, 2026
Researchers uncovered a previously undocumented **12 KB custom Windows backdoor** on a single domain-joined **Windows 7 SP1 x64** corporate workstation after spotting unusual **WMI persistence**. The malware masqueraded as Realtek software, using a WMI event subscription named **`Realtek`** to launch **`RtkNGUI64.exe`** each evening, and concealed its command-and-control domain in **`C:\ProgramData\desktop.ini`** by encoding data as counts of UTF-16 whitespace after a legitimate-looking header. Decoding the file reconstructed **`diagrtrack.com`**, a typosquatted domain resembling Microsoft DiagTrack naming. The implant used an **ICMP knock** before sending **HTTP POST** beacons to **`/version/check.php`**, with a victim identifier derived from CRC-32 values tied to the host and user. Its functionality was limited but operationally useful, supporting shell command execution, file writing, and polling interval changes, while analysis found no packer, anti-debugging, or links to a known threat actor. Investigators said the malware showed **zero known prevalence** over more than five years, the domain had been registered in 2020 and expired in 2021, and no additional victims or related samples were identified, suggesting a selectively deployed operation whose persistence remained active even after the C2 infrastructure disappeared.
Aug 17, 2026
Researchers reported a highly targeted intrusion campaign that concealed its final-stage payload by storing encrypted shellcode inside Windows event logs, giving attackers a stealthy way to maintain a **fileless** presence on compromised systems. Observed from September 2021 through at least February 2022, the operation used a multi-stage chain that combined commercial offensive tools including **Cobalt Strike** and **SilentBreak** with custom anti-detection wrappers, **DLL sideloading**, memory injection, and patching of **ETW** and **AMSI** to reduce visibility. The attackers also used signed malware, victim-tailored domain mimicry, and infrastructure hosted with providers including **Linode**, **Namecheap**, and **DreamVPS**. Persistence was established by copying `WerFault.exe` and a malicious `wer.dll` into `C:\Windows\Tasks`, while later-stage RAT variants communicated over **HTTP** or named pipes and supported reconnaissance, command execution, file operations, credential theft, screenshot capture, privilege abuse, and lateral movement. Researchers did not attribute the activity to a known threat actor and provisionally labeled the operation **SilentBreak** because that toolset featured prominently in the campaign.
Aug 14, 2026