SLEEPWALKER: a backdoor that ships its own 23-instruction language, and nothing to block until it wakes

The two layers of opacity are worth separating, because only one of them is hard. The outer layer is ordinary cryptography: AES-256-CCM with a verified authentication tag, provided by a statically linked copy of mbedTLS rather than anything loaded at runtime, which also removes the runtime dependency a defender might otherwise notice [s1 c8][s1 c11]. The inner layer is where the analyst time goes. What comes out of the decryption is not readable text but a program for a bytecode interpreter that exists only inside this file, so a recovered key yields a blob whose meaning still has to be reconstructed instruction by instruction [s1 c2][s1 c3].

At rest, the file is close to inert. Its built-in configuration decrypts to a single bootstrap command: watch every network interface indefinitely for the trigger [s1 c8]. A memory scan hunting for command strings therefore finds a sniffer holding no orders, and a firewall has nothing to deny until the operator chooses to send one packet, which can sit inside traffic that looks entirely normal, including a crafted DNS query [s1 c9][s1 d3].

Count the ways in and the arithmetic is unfriendly. Reichel lists TCP, UDP, ICMP, SMB named pipes with lateral movement using supplied credentials, VMware's internal VMCI channel between a guest and its host, and raw-socket promiscuous sniffing, with DNS queries as a second trigger channel [s1 c9]. That is seven paths to cover ^[20]. The VMCI one deserves attention on its own terms: a guest-to-host channel is not where most network monitoring is pointed.

The durable artifact is not on the wire at all. To allow unauthenticated named-pipe access, the implant enables anonymous SMB access and creates pipes with permissions granted to Everyone and Anonymous Logon [s1 c10]. That is a configuration change that persists whether or not a trigger ever arrives, and it does not distinguish between the operator and anyone else on the segment ^[21]. It is also the sloppiest thing in the design, which fits Reichel's own assessment that the implementation has several weaknesses and is not top-notch work, possibly an early build [s1 c13].

The activation gate is similarly thin: SLEEPWALKER checks only the name of its host process, not its signature or path, and does nothing unless that name is ERAAgent.exe [s1 c6]. The carrier is an unsigned 64-bit DLL that copies ESET's file information and forges an ESET Management Agent version resource [s1 c5][s1 c17]. ESET's description of the agent, quoted in the write-up, is the reason the choice is not arbitrary: it connects managed endpoints and servers to the management platform and stores and enforces policies locally [s1 c7].

What is missing is context. Reichel says the code is unfamiliar to him and declines attribution, while judging the implant most likely one component of a targeted intrusion alongside others not yet identified [s1 c14]. SC Media, relaying The Register, records the same gap: no victim, industry or origin, for lack of collection context [s2 c16]. The published detection material is a YARA rule and a read-only scanner script in the appendix [s1 c15].