DevThe Hacker Newsabout 3 hours ago
SLEEPWALKER Backdoor Waits for One Packet
1 min read
A new Windows backdoor, SLEEPWALKER, stays inert until a crafted packet triggers its 23-instruction bytecode. The unsigned 59,904-byte DLL side-loads into ERAAgent.exe, impersonates dpapi.dll, and uses AES-256-CCM. It makes no outbound connections, hiding infections. ESET has issued no advisory as of August 26.
Level
Hype check
Tap to vote and see what everyone thinks.
Summary by ByteBrief
