Loading story…
Researchers identified SLEEPWALKER, an unsigned 64-bit Windows DLL backdoor that masquerades as dpapi.dll and is designed to be side-loaded by the ESET Management Agent process, ERAAgent.exe. Unlike conventional implants, it does not beacon to fixed command-and-control infrastructure; it remains dormant until it receives a specially crafted, encrypted network packet, then decrypts and executes attacker tasking.
The malware uses a proprietary 23-instruction bytecode interpreter supporting task scheduling, staged payload delivery, lateral movement, multiple communications channels, and direct in-memory shellcode execution. The analyzed sample enables a raw-packet listener and places interfaces in promiscuous mode; code also suggests potential triggering or communications over DNS, TCP, UDP, ICMP, SMB named pipes, and VMware VMCI. No threat actor, victim, delivery vector, campaign, or confirmed real-world use has been identified. Defenders should investigate untrusted DLLs loaded by management agents, promiscuous packet capture, unusual named-pipe or SMB configuration changes, suspicious pipes, and anomalous in-memory activity.
Pull IOCs and campaign context straight into your stack.
1 event from the most recent confirmed update back to the earliest known activity.
PolySwarm identified SLEEPWALKER, an unsigned 64-bit DLL masquerading as dpapi.dll and designed for DLL side-loading into the ESET Management Agent process ERAAgent.exe. The analyzed implant passively awaits encrypted raw-packet tasking rather than using fixed C2 infrastructure or autonomous beaconing; no actor, victim, campaign, delivery chain, or confirmed live use was identified.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
3 references tracked. Mallory keeps watching after this page renders.
cryptika.com
Open sourcecybersecuritynews.com
Open sourceblog.polyswarm.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers have documented a previously unknown Windows backdoor dubbed **Sleepwalker** that stays dormant in memory until it receives a specially crafted network "magic packet," allowing it to avoid traditional command-and-control patterns. The malware impersonates Microsoft's `dpapi.dll` and is loaded through DLL side-loading with ESET's `ERAAgent.exe`/ESET Management Agent, then passively monitors network traffic for AES-256-CCM-encrypted tasking instead of beaconing outward. Analysis by malware researcher Dominik Reichel found that Sleepwalker uses a custom 23-instruction command language to decrypt and execute operator commands. Once activated, Sleepwalker can execute code in memory, transfer or exfiltrate data, and receive staged payloads, with some functionality indicating it can also communicate through VMware VMCI targets. Researchers said the tradecraft points to a stealthy, well-resourced, and likely targeted operation, but no victim identities, affected sectors, intrusion timeline, or operator attribution have been confirmed. Reichel has also released a toolkit intended to help defenders detect and mitigate the implant.
Aug 27, 2026
Elastic Security Labs identified **PIPEDANCE**, a previously unknown Windows backdoor used in an intrusion against a Vietnamese organization. The malware uses encrypted Windows named-pipe communications for command and control, enabling interactive command execution, host and process discovery, file operations, network-egress testing, lateral movement, and deployment of additional implants. Its RC4 encryption key is derived from a hard-coded pipe name, complicating inspection of its local interprocess communications. During the intrusion, PIPEDANCE appeared alongside Cobalt Strike, which was injected into the legitimate `openfiles.exe` utility following execution involving `DbgView.exe`, `makecab.exe`, and `typeperf.exe`. The backdoor supports process injection through thread-execution hijacking and Heaven's Gate techniques. Elastic released behavioral detections, a hunting query, a YARA rule, and a PIPEDANCE emulation client that defenders can use in controlled environments to validate endpoint telemetry, detections, network analysis, and prevention controls.
Sep 9, 2026
Researchers detailed two separate malware chains that rely on deeply layered staging, DLL sideloading, and trusted signed software to conceal execution. One campaign, dubbed **Eimeria**, starts from a `RAR5` archive containing the signed `dsclock.exe`, a malicious `zlibwapi.dll`, and an encrypted payload that decrypts into an IExpress package and then an AutoIt-based RunPE loader. The chain restores `ntdll.dll` to evade EDR hooks, decrypts later stages with `AES-128-CBC`, `RC4`, and `LZNT1`, hollows `explorer.exe`, `svchost.exe`, or `taskhostw.exe`, and injects a small .NET RAT that beacons over WebSocket to `94.26.90.139:3006`. It also sets persistence through a Run key and scheduled task and uses delays, sleep checks, and CPU and memory stress tests to frustrate analysis. A second intrusion set tied to **UAC-0184 / MB-0007** used Ukraine-themed lures and messenger delivery to target Ukrainian Defense Forces personnel, beginning with `LNK` files that called `bitsadmin` to fetch `HTA` content from `169.40.135.35` for execution via `mshta`. The downloaded archive abused legitimate Plane9 components for sideloading through `Cluster-Overlay64.exe`, `Plane9Engine.dll`, and `openvr_api.dll`, then decoded `kernel-diag.lib` into `evr.dll` and unpacked `filter.bin` by rebuilding `IDAT` chunks, XOR-decoding with key `0x227E9BDE`, and decompressing with `LZNT1`. The final bundle included signed utilities such as Microsoft-signed `VSLauncher.exe` and a renamed PassMark Endpoint DLL, indicating the actor likely repurposed a signed network stack and dump-capable tooling for covert internal communications, with controller details possibly discovered dynamically over multicast `224.0.0.255:31339` and TCP `31339` rather than a fixed external C2.
Jun 29, 2026