Loading today’s stories
Security2 distinct publishers3 min readPublished
Dominik Reichel's write-up describes a passive Windows implant with no listening port and no embedded payload. Recovering its AES key still leaves you holding bytecode for an interpreter only it understands.
The Watch · Security desk
Compiled by The WatchSomething wrong?How this is made
The two layers of opacity are worth separating, because only one of them is hard. The outer layer is ordinary cryptography: AES-256-CCM with a verified authentication tag, provided by a statically linked copy of mbedTLS rather than anything loaded at runtime, which also removes the runtime dependency a defender might otherwise notice [s1 c8][s1 c11]. The inner layer is where the analyst time goes. What comes out of the decryption is not readable text but a program for a bytecode interpreter that exists only inside this file, so a recovered key yields a blob whose meaning still has to be reconstructed instruction by instruction [s1 c2][s1 c3].
At rest, the file is close to inert. Its built-in configuration decrypts to a single bootstrap command: watch every network interface indefinitely for the trigger [s1 c8]. A memory scan hunting for command strings therefore finds a sniffer holding no orders, and a firewall has nothing to deny until the operator chooses to send one packet, which can sit inside traffic that looks entirely normal, including a crafted DNS query [s1 c9][s1 d3].
Count the ways in and the arithmetic is unfriendly. Reichel lists TCP, UDP, ICMP, SMB named pipes with lateral movement using supplied credentials, VMware's internal VMCI channel between a guest and its host, and raw-socket promiscuous sniffing, with DNS queries as a second trigger channel [s1 c9]. That is seven paths to cover [1]. The VMCI one deserves attention on its own terms: a guest-to-host channel is not where most network monitoring is pointed.
The durable artifact is not on the wire at all. To allow unauthenticated named-pipe access, the implant enables anonymous SMB access and creates pipes with permissions granted to Everyone and Anonymous Logon [s1 c10]. That is a configuration change that persists whether or not a trigger ever arrives, and it does not distinguish between the operator and anyone else on the segment [2]. It is also the sloppiest thing in the design, which fits Reichel's own assessment that the implementation has several weaknesses and is not top-notch work, possibly an early build [s1 c13].
The activation gate is similarly thin: SLEEPWALKER checks only the name of its host process, not its signature or path, and does nothing unless that name is ERAAgent.exe [s1 c6]. The carrier is an unsigned 64-bit DLL that copies ESET's file information and forges an ESET Management Agent version resource [s1 c5][s1 c17]. ESET's description of the agent, quoted in the write-up, is the reason the choice is not arbitrary: it connects managed endpoints and servers to the management platform and stores and enforces policies locally [s1 c7].
What is missing is context. Reichel says the code is unfamiliar to him and declines attribution, while judging the implant most likely one component of a targeted intrusion alongside others not yet identified [s1 c14]. SC Media, relaying The Register, records the same gap: no victim, industry or origin, for lack of collection context [s2 c16]. The published detection material is a YARA rule and a read-only scanner script in the appendix [s1 c15].
Ranked by verification strength, evidence, and original report placement.
SLEEPWALKER is a passive backdoor that opens no obvious listening port and carries no payload inside itself; it waits in memory doing nothing until one specifically crafted network packet reaches the machine. It was discovered and named by Dominik Reichel.
The trigger packet carries not a readable command but a short program written in a command language of the backdoor's own design, with 23 instructions covering scheduling, several ways to move data, staged file delivery and running code directly in memory.
Recovering the encryption key is not enough to understand one of these programs; the internal command language must be reverse engineered as well.
SLEEPWALKER never contacts a fixed C2 address; instead it sniffs the network for a covert trigger packet, then decrypts and runs an attacker-supplied task program delivered as bytecode.
The carrier file is a 64-bit Windows DLL that impersonates Microsoft's dpapi.dll and has a forged ESET Management Agent version resource, designed to be side-loaded into ERAAgent.exe, the Windows executable for ESET Management Agent.
The configuration built into the file decrypts with AES-256-CCM and a verified authentication tag to a single bootstrap command: watch every network interface indefinitely for the trigger.
Follow any of these and your For You feed starts watching them — no settings page required.
Evidence-backed comparisons of source perspectives and observed adoption signals. Read the methodology
Which Builder, Operator, and Investor concerns the observed source mix emphasized—not a truth score.
Evidence, demonstrated adoption, hype gap, incentives, and confidence are assessed independently, each on its own current evidence. How these are measured.
Strong first-party technical evidence, single analyst and single sample
The primary source is a hands-on reverse-engineering write-up with sample hashes, imphash, compilation timestamp, the exported dpapi.dll function list, the AES-256-CCM configuration structure, an enumerated 23-instruction interpreter, transport inventory, plus a YARA rule and scanner script - all falsifiable artifacts. It is discounted because everything rests on one analyst examining one sample, the second source is a derivative brief citing The Register rather than independent verification, and no vendor or victim telemetry corroborates it.
Real-world prevalence unknown
Supplied sources describe one sample and explicitly state that victims, industry and origin are unknown due to a lack of collection context. There is no victim count, sector, geography, telemetry, incident-response engagement or defender-deployment data on which to base an adoption score, and the only measurable events are the publication of the analysis and its trade-press pickup.
Slightly understated
Claims here are unusually well calibrated: the discovering researcher volunteers that the engineering is not top-notch, declines attribution, and notes this may be an early build, while the trade brief flags unknown victims and origin. If anything the practically important finding is under-emphasised in coverage - the persistent anonymous-SMB and Everyone / Anonymous Logon pipe weakening exists whether or not a trigger ever arrives, and the derivative brief omits it entirely in favour of the novel-language angle.
Modest reputational and traffic incentives, no product pitch
The primary source is an independent researcher's personal blog: the incentive is reputational credit for naming and dissecting a novel implant, and the post narrates its own provenance (backlog work after losing VirusTotal Intelligence access) rather than promoting a commercial product. Notably the impersonated vendor is not the publisher, so no vendor is marketing against its own finding. The secondary source is aggregation of another outlet's reporting, which carries a traffic incentive to lead with the 'custom command language' novelty.
Confident on mechanics, silent on scope
High confidence in the technical description - it is first-party, artifact-rich, internally consistent and echoed by trade coverage - but the cluster contains only two publishers, one of which is derivative, and adoption is unmeasurable. Confidence would rise with independent vendor analysis of the same hash or any victim telemetry.
product
The UK plant that went dark for four days was too small to have to tell anyone1 distinct publisher
security
Agent Tesla v4 hides in emoji and never hits disk: an email-rule problem, not a new-malware one2 distinct publishers
product
Cinemas, classrooms and ICE: smart glasses now need a venue-policy contingency1 distinct publisher
build
GitLab bundles a zero-click GraphQL flaw with a CSRF bug, and only one needs a victim1 distinct publisher
Distinct publishers with included, body-backed reporting in this cluster.
1 article · August 25, 2026
1 article · August 25, 2026