Newly Discovered SLEEPWALKER Backdoor Triggers Execution via Crafted Network Packet

An independent malware researcher has documented a previously unreported Windows backdoor, dubbed SLEEPWALKER, that stays inert in memory until a specifically crafted network packet reaches the machine and then runs commands written in a 23-instruction language of its own design.

The sample is an unsigned 64-bit Windows dynamic-link library (DLL) of 59,904 bytes, built to be side-loaded into running processes. Once triggered by the crafted packet, the backdoor interprets its custom bytecode to execute attacker-controlled instructions. The use of a custom instruction set and a network-packet trigger mechanism indicates a design focused on evasion and targeted delivery. As of the report date, no public exploit code or widespread exploitation has been observed, but the capability for remote code execution via bytecode interpretation poses a significant risk to affected systems. The researcher notes that mitigation likely involves preventing unauthorized DLL side-loading and monitoring for anomalous network traffic patterns targeting system processes.