Analysis of the SLEEPWALKER Backdoor: Crafted Packet Triggers Custom Bytecode Execution

A newly discovered Windows backdoor, SLEEPWALKER, remains dormant until triggered by a specific network packet, then executes custom bytecode. It uses side-loading techniques and lacks traditional persistence, making it a post-compromise implant with limited detection coverage.

An independent malware researcher has documented a previously unreported Windows backdoor, dubbed SLEEPWALKER, that stays inert in memory until a specifically crafted network packet reaches the machine and then runs commands written in a 23-instruction language of its own design.

The sample is an unsigned 64-bit Windows dynamic-link library (DLL) of 59,904 bytes, built to be side-loaded into&

Read original article