New Windows Backdoor ‘SLEEPWALKER’ Employs Stealthy Packet and VMware Channels to Bypass Detection

A recently dissected Windows backdoor, dubbed SLEEPWALKER, has been found to rely on a passive command‑and‑control (C2) architecture that sidesteps traditional beacon‑based detection methods. Researchers from the GBHackers community first disclosed the malware, noting its ability to remain dormant until it receives a specific raw‑network packet, a technique that reduces its observable traffic footprint.

Unlike conventional malware that periodically checks in with a C2 server, SLEEPWALKER activates only after detecting a uniquely crafted packet on the network interface. This raw‑packet trigger allows the malicious code to sit idle for extended periods, making it difficult for security tools that monitor regular outbound connections to spot any anomalous activity.

Once awakened, the backdoor can retrieve instructions through DNS queries, leveraging the ubiquity and low‑profile nature of domain name resolution. By embedding task data inside DNS request or response fields, the malware blends its traffic with normal DNS lookups, further complicating network‑based detection. Analysts also observed that the payload remains in memory, avoiding the creation of files on disk, which hampers signature‑based antivirus scans.

In addition to DNS, SLEEPWALKER exploits VMware’s Virtual Machine Communication Interface (VMCI) when it runs inside a virtualized environment. The VMCI channel provides a direct, high‑speed conduit between the guest operating system and the host, enabling the backdoor to exchange commands and exfiltrate data without traversing the external network stack. This use of virtualization‑specific pathways is uncommon among Windows threats and underscores the malware’s focus on evading conventional network monitoring.

The malware also incorporates named‑pipe mechanisms to facilitate inter‑process communication on the infected host. By creating and monitoring named pipes, SLEEPWALKER can coordinate multiple malicious components while keeping the activity confined to internal system resources, a tactic that further reduces its visibility to endpoint detection platforms that prioritize external network indicators.

Security experts warn that the combination of raw‑packet activation, DNS tunneling, VMCI usage, and in‑memory execution represents a sophisticated blend of techniques aimed at high‑value targets that employ layered defenses. While the full scope of SLEEPWALKER’s campaign remains unknown, the discovery highlights the need for organizations to augment traditional signature‑based defenses with behavioral analytics capable of spotting atypical packet patterns, unusual DNS usage, and suspicious virtual‑machine interactions.