Insights, news, education and announcements from PolySwarm | ESET Management Agent malware

SLEEPWALKER: Passive Backdoor Awakens Only When Attackers Call

Aug 31, 2026, 2:54:48 PM / by The Hivemind posted in Threat Bulletin, DLL side-loading, passive backdoor, ESET Management Agent malware, ERAAgent.exe, SLEEPWALKER malware

Executive Summary

SLEEPWALKER is a novel passive Windows backdoor. The malware is designed for DLL side-loading into the ESET Management Agent process ERAAgent.exe and does not autonomously beacon or contain fixed C2 infrastructure. Instead, SLEEPWALKER remains dormant until receiving a specially crafted network packet, then decrypts and executes attacker-supplied bytecode through a custom 23-instruction command language supporting scheduling, multiple communications mechanisms, staged payload delivery, lateral movement, and in-memory code execution.

Read More