SLEEPWALKER Backdoor Hides in a Security Agent and Wakes Up for One Packet

Sun, 30 Aug 2026 12:13:30 +0200

SLEEPWALKER Backdoor Hides in a Security Agent and Wakes Up for One Packet

5 bytes of orders sit inside a backdoor that has never once called home. It reads what crosses your network cable and waits. The security agent it hides in loads it again at each restart.

Dominik Reichel, who used to hunt malware at Palo Alto Unit 42, published the analysis on August 24. He named it SLEEPWALKER, because that is what it does. It sits in memory and does nothing at all until one specific packet crosses the network cable, and then it wakes up and runs whatever the sender told it to run.

Reverse Engineering on HackingPassion.com : root@HackingPassion.com-[~]

SLEEPWALKER Backdoor Hides in a Security Agent and Wakes Up for One Packet

SLEEPWALKER Backdoor Hides in a Security Agent and Wakes Up for One Packet