dpapisvc.dll

SLEEPWALKER Backdoor Stays Dormant Until Triggered by Single Custom Network Packet

SLEEPWALKER is a stealthy Windows backdoor that remains inactive until it receives one specially crafted encrypted network packet. The implant then decrypts and executes custom bytecode from a proprietary 23-instruction language, enabling chained tasks, data movement, and in-memory code execution without prior outbound communication. The 64-bit DLL masquerades as dpapi.dll and is designed for DLL side-loading into ERAAgent.exe, the executable of the ESET Management Agent used in ESET PROTECT deployments. It inspects raw network traffic in promiscuous mode, supports multiple transport protocols including TCP, UDP, ICMP, SMB named pipes, and VMware VMCI, and can weaken security by modifying registry values such as EveryoneIncludesAnonymous. No confirmed victims or attribution have been identified, and the analysis is based on a single sample. Researchers recommend auditing endpoints for unexpected dpapi.dll files alongside ERAAgent.exe and reviewing related registry settings.