Custom bytecode command languages in malware

SLEEPWALKER: a backdoor that ships its own 23-instruction language, and nothing to block until it wakes

Dominik Reichel's write-up describes a passive Windows implant with no listening port and no embedded payload. Recovering its AES key still leaves you holding bytecode for an interpreter only it understands.