Suspicious URL checker analysis is only one part of the investigation when malware deliberately avoids the network behaviors defenders normally expect. A newly documented Windows backdoor named SLEEPWALKER can remain dormant until it receives a specially crafted packet, while its analyzed code also contains support for DNS-based triggering and VMware’s Virtual Machine Communication Interface (VMCI). Security researcher Dominik Reichel published the technical analysis on August 24, 2026.

The discovery matters because SLEEPWALKER does not depend on a conventional command-and-control domain, fixed IP address, or periodic outbound beacon. Instead, it waits for an operator-controlled trigger and then interprets encrypted bytecode containing instructions. That architecture creates detection challenges for SOC teams relying heavily on domain reputation, DNS monitoring, or outbound network connections.

What Is SLEEPWALKER Malware?

SLEEPWALKER is a passive Windows backdoor identified by researcher Dominik Reichel. The analyzed sample is an unsigned 64-bit DLL designed to masquerade as Microsoft’s dpapi.dll and to be loaded through DLL side-loading by ERAAgent.exe, the Windows executable associated with ESET Management Agent.

The sample does not contain a conventional second-stage payload or hard-coded command-and-control infrastructure. After loading in the expected process, its embedded configuration instructs it to monitor network interfaces and wait for a matching trigger packet.

The researcher describes a custom 23-instruction command language capable of scheduling activity, moving data, staging payloads, and executing code in memory. The implementation also includes multiple communication mechanisms, including TCP, UDP, ICMP, SMB named pipes, raw packet capture, and VMware VMCI.

No specific threat actor, victim, or active campaign has been publicly attributed to the sample in the research reviewed for this article. The capabilities described in the code should therefore not be interpreted as proof that every supported communication mechanism has been used operationally.

Why SLEEPWALKER’s Passive Design Challenges Detection

Traditional network detection frequently looks for an infected system contacting a suspicious domain, IP address, or known command-and-control server. SLEEPWALKER changes that assumption.

According to the technical analysis, the backdoor does not independently contact a fixed server when it starts. Instead, it waits for a specially constructed packet. It can inspect traffic at the raw-packet level and only responds when the packet passes multiple validation checks.

This means the absence of suspicious outbound connections does not necessarily establish that the host is clean.

The distinction is important for threat hunters:

• Traditional beaconing: compromised host initiates communication.
• Passive triggering: compromised host waits for an external signal.
• Domain-based C2: defenders may investigate domains and DNS resolutions.
• Raw-packet triggering: the trigger may not depend on a conventional domain or URL.
• VMCI communication: traffic can move through the virtualization layer rather than a physical network interface.

CISA’s guidance on protocol tunneling similarly explains that adversaries can encapsulate communications inside other protocols to conceal traffic or bypass network filtering.

How Raw Packets Become a Covert Trigger

The most unusual feature in the analyzed configuration is its raw-packet listener.

The backdoor watches network interfaces for a specific packet structure. Reichel’s analysis describes validation involving packet length, calculated values, CRC-32 validation, and AES-256-CCM decryption before the contents are treated as a command. A packet that fails validation is ignored.

This creates an important defensive lesson. A network sensor does not necessarily need to identify a malicious domain to detect the behavior. Host telemetry, packet-level visibility, process lineage, and unexpected network-interface behavior can be equally important.

The malware’s commands are also not ordinary text instructions. They are programs written in a proprietary bytecode language containing 23 instructions. That makes simple string-based inspection less useful and increases the importance of behavioral detection.

DNS Adds Another Layer of Covert Communication

SLEEPWALKER also contains a DNS-based trigger capability. However, the distinction between implemented functionality and observed behavior is important: the analyzed sample activates the raw-packet listener, while the DNS trigger capability exists in the binary but was not enabled in that configuration.

The DNS mechanism is designed to carry encrypted command data through DNS query labels. The researcher documented Base32 encoding being used to make the encrypted data suitable for DNS labels.

DNS is attractive to attackers because organizations commonly permit DNS resolution throughout enterprise environments. CISA’s Protective DNS guidance describes how DNS telemetry and threat intelligence can be used to identify malicious events, including indicators associated with malware and command-and-control activity.

For defenders, the lesson is not that every unusual DNS query represents malware. Instead, analysts should correlate DNS behavior with endpoint and identity evidence.

VMware VMCI Creates a Different Visibility Problem

VMCI is particularly relevant for organizations running VMware environments.

SLEEPWALKER implements communication through VMware’s Virtual Machine Communication Interface, allowing communication between a guest and its host or between guests on the same physical host, according to the technical analysis. Because VMCI operates through the virtualization layer rather than a conventional physical network interface, traffic may not appear in network captures taken between machines.

That creates a visibility gap for teams that depend exclusively on perimeter network monitoring.

Virtualization security therefore needs to be considered separately from conventional north-south traffic inspection. A SOC investigating a suspicious Windows workload should correlate endpoint processes with hypervisor activity, VM configuration, administrative events, and unexpected guest-to-host communication where the environment provides that telemetry.

Why URL Intelligence Still Matters

At first glance, SLEEPWALKER appears to have little connection to URL security because the analyzed sample contains no hard-coded C2 domains, IP addresses, or URLs. That is precisely why URL intelligence needs to be used as one layer rather than the entire detection strategy.

A suspicious URL checker can help analysts evaluate links, domains, or websites found elsewhere in an investigation. If a related phishing email, redirect, malware-delivery page, or newly registered domain appears during incident response, analysts can investigate its reputation and behavioral signals without assuming that the URL itself proves compromise.

urlScore’s current platform states that it evaluates URLs using multiple checks involving factors such as domain age, blacklist matches, SSL information, redirects, content signals, DNS information, and other indicators. It also integrates threat-intelligence sources including URLhaus, PhishTank, Phishunt, OpenPhish, and Tranco.

This type of analysis is complementary to endpoint and network detection. It should not be treated as evidence that SLEEPWALKER itself uses a malicious URL.

What SOC Teams Should Investigate

The SLEEPWALKER analysis suggests several useful defensive investigation areas.

Endpoint and process telemetry

Look for unexpected DLL loading associated with ERAAgent.exe, particularly where a file masquerades as a legitimate Windows library. Validate file signatures, paths, hashes, timestamps, and module relationships rather than trusting filenames alone.

Network-interface behavior

Investigate unexpected packet-capture or promiscuous-mode behavior on Windows endpoints. The presence of such behavior is not automatically malicious, but it warrants correlation with process activity and system configuration.

DNS telemetry

Review unusual DNS patterns, especially when they coincide with suspicious endpoint activity. Look for anomalous query characteristics and investigate them in context rather than blocking solely because a domain is newly registered.

Virtualization telemetry

For VMware environments, determine what visibility exists into VMCI communications and guest-to-host activity. Network sensors positioned only between virtual machines may not provide complete visibility into virtualization-layer communications.

Memory and behavioral evidence

Because SLEEPWALKER can interpret commands and execute code in memory, memory analysis and behavioral endpoint telemetry may provide evidence that ordinary file scanning misses.

Security Checklist for SLEEPWALKER-Like Threats

Security teams can prioritize the following actions:

• Verify unexpected DLLs loaded by trusted management applications.
• Compare file signatures and hashes against approved software baselines.
• Investigate suspicious process-to-DLL relationships.
• Review endpoints exhibiting unexpected packet-capture behavior.
• Monitor DNS telemetry for anomalous query behavior.
• Correlate DNS events with endpoint and authentication telemetry.
• Assess visibility into VMware guest-to-host communications.
• Review unexpected SMB named-pipe activity.
• Investigate unexplained in-memory execution.
• Use URL intelligence when suspicious links, domains, or web infrastructure appear during the investigation.
• Avoid treating a reputation score or single IOC as conclusive evidence.
• Preserve relevant forensic evidence before remediation where incident-response procedures require it.

How URL Risk Intelligence Fits Into a Broader Detection Strategy

SLEEPWALKER demonstrates why security operations should combine multiple intelligence layers.

A domain reputation API can help automate evaluation of domains discovered in email, proxy, DNS, or threat-intelligence feeds. A URL analysis platform can also help prioritize unknown websites for analyst review. Meanwhile, endpoint detection, network telemetry, virtualization monitoring, identity security, and threat hunting address behaviors that URL analysis cannot see.

For teams processing large volumes of links, urlScore provides documented API functionality for URL checks, scan history, and scan-profile management.

Its documented use cases also include SOC/SIEM enrichment, domain monitoring, threat intelligence, and automated URL evaluation.

For organizations that need additional context around phishing and suspicious websites, the urlScore URL threat intelligence blog provides research and security-focused material covering malicious domains detection, phishing, and URL classification.

A real-time dark web monitoring solution can also complement this approach when investigations involve exposed credentials, threat-actor discussions, or leaked infrastructure information. However, dark web intelligence should similarly be treated as an investigative signal rather than automatic proof of compromise.

Frequently Asked Questions

Is SLEEPWALKER a confirmed active malware campaign?

The available research confirms the existence and capabilities of the analyzed SLEEPWALKER sample, but it does not establish a specific active campaign, victim set, or threat actor. The researcher explicitly states that the malware could not be attributed to a particular actor. Organizations should therefore distinguish the technical capabilities of the sample from evidence of operational deployment.

Does SLEEPWALKER use DNS for command and control?

The analyzed malware contains a DNS-based trigger mechanism capable of carrying encrypted commands in DNS labels. However, the analyzed configuration had the raw-packet trigger enabled rather than the DNS trigger. Therefore, DNS support should be described as an implemented capability, not evidence that DNS was used in a confirmed intrusion.

Why is VMware VMCI significant for defenders?

VMCI can provide communication through the virtualization layer between VMware guests and their host environment. Because this traffic does not necessarily traverse a conventional network interface, traditional network packet captures may not provide complete visibility. Organizations should therefore consider virtualization-layer telemetry alongside endpoint and network monitoring.

Can a suspicious URL checker detect SLEEPWALKER?

A suspicious URL checker is not designed to detect every malware implant, particularly one that can operate without hard-coded URLs or outbound C2. Its value is different: analysts can use URL intelligence to investigate suspicious domains or web infrastructure discovered during phishing, malware, DNS, or incident-response investigations.

Analyze Suspicious URLs Before They Become Incident Indicators

SLEEPWALKER is a reminder that modern threat detection cannot rely on a single indicator type. Raw packets, DNS, virtualization‑layer communication, process behavior, and external infrastructure all contribute to an investigation. For teams needing additional context when suspicious links or domains appear in security workflows, urlScore provides URL risk analysis and threat‑intelligence enrichment alongside existing SOC controls. Organizations can analyze suspicious URLs with urlScore and use the results as one evidence source within a broader investigation and response process. Get started now.

Disclaimer: urlScore reports on publicly available threat-intelligence sources. Inclusion of an organization in an article does not imply confirmed compromise. All claims are attributed to external sources unless explicitly verified.