New Windows malware lays dormant until a custom command activates it like a sleeper agent

• Researcher Dominik Reichel found SLEEPWALKER, a silent malware implant disguised as ESET’s agent
• It contains no malicious code, activates only after receiving crafted network signals
• Likely a nation‑state project targeting specific victims; no active campaigns confirmed yet

Security researchers discovered a new and rather unusual piece of malware.

Most malware come with a built-in, pre-defined set of tools and features: system fingerprinting, network mapping, data exfiltration, keylogging, screenshots, tapping into the camera and microphone. When they infect a machine, they first try to phone home using the device’s internet connection and await instructions on which of the features to use.

But security researcher Dominik Reichel found something entirely different: a piece of malware not having any of the above, designed to remain almost completely silent until being “woken up”. He named it SLEEPWALKER.

No active campaigns

This implant has no malicious code, and therefore nothing that would get flagged by security software. It hides in plain sight, masquerading as a legitimate Windows component for ESET’s Management Agent. This allows it to run from within a trusted app, instead of being a standalone program that could invite scrutiny.

SLEEPWALKER listens to network traffic for a specially crafted signal, waking up only when it is received. That signal also “teaches” the malware what it can do – schedule different activities, communicate with other systems, receive additional programs, and even execute code.

The malware was submitted to VirusTotal sometime last year, Reichel said. It was not found in any active campaigns, and there are no confirmed victims, industries, countries, or organizations associated with the sample. Reichel also stressed that it’s unknown how the malware initially entered the reporter’s environment, who runs it, and what additional tools may have accompanied it.

He also said that the code is somewhat “rough around the edges”. Despite its unusual design, it comes with several weaknesses, which might suggest that SLEEPWALKER was a work in progress. He doesn’t know if there are newer variants in the wild, though.

Still, given the nature of the malware, Reichel doesn’t think it was built for indiscriminate attacks. Instead, it was most likely designed by nation-states with specific targets in mind.

Via The Register