I found a previously undocumented passive Windows backdoor I’m calling SLEEPWALKER. Its defining feature is a custom command language with 23 instructions. Instead of receiving conventional commands, it runs encrypted bytecode programs that can combine scheduling, nested programs, staged payload delivery with SHA-256 verification, decompression, network communication and in-memory shellcode execution. The analyzed file is an unsigned DLL that masquerades as Microsoft's dpapi.dll, uses forged ESET metadata and activates only when side-loaded by ESET's Management Agent program ERAAgent.exe. SLEEPWALKER does not beacon or open an obvious listening port on its own. It monitors network traffic and stays dormant until it detects a specially crafted packet carrying an AES-256-CCM-protected task. It supports TCP, UDP, ICMP, SMB named pipes and VMware VMCI. VMCI can carry traffic directly between a VMware guest and host without using a conventional network interface. SLEEPWALKER also implements a DNS trigger that uses Base32 to carry encrypted tasks inside DNS labels, although the analyzed sample does not enable it. The full analysis documents the bytecode format, all 23 instructions, encryption, DNS encoding, trigger logic and network transports. It also includes IOCs, a YARA rule and a PowerShell scanner. If you believe you have been targeted by SLEEPWALKER or have found a related sample, please contact me. I created the SLEEPWALKER Analysis Toolkit to decode its bytecode, examine artifacts and safely reproduce its receiving pipeline without executing commands or transmitting data. If you suspect you've been infected, I am happy to share this toolkit with you, alongside a mitigation guide providing investigation steps and a remediation script for use after detection. r136a1.dev/2026/08/24/sleepw…