Antelox

I found a previously undocumented passive Windows backdoor I’m calling SLEEPWALKER. Its defining feature is a custom command language with 23 instructions. Instead of receiving conventional commands, it runs encrypted bytecode programs that can combine scheduling, nested programs, staged payload delivery with SHA-256 verification, decompression, network communication and in-memory shellcode execution. The analyzed file is an unsigned DLL that masquerades as Microsoft's dpapi.dll, uses forged ESET metadata and activates only when side-loaded by ESET's Management Agent program ERAAgent.exe. SLEEPWALKER does not beacon or open an obvious listening port on its own. It monitors network traffic and stays dormant until it detects a specially crafted packet carrying an AES-256-CCM-protected task. It supports TCP, UDP, ICMP, SMB named pipes and VMware VMCI. VMCI can carry traffic directly between a VMware guest and host without using a conventional network interface. SLEEPWALKER also implements a DNS trigger that uses Base32 to carry encrypted tasks inside DNS labels, although the analyzed sample does not enable it. The full analysis documents the bytecode format, all 23 instructions, encryption, DNS encoding, trigger logic and network transports. It also includes IOCs, a YARA rule and a PowerShell scanner. If you believe you have been targeted by SLEEPWALKER or have found a related sample, please contact me. I created the SLEEPWALKER Analysis Toolkit to decode its bytecode, examine artifacts and safely reproduce its receiving pipeline without executing commands or transmitting data. If you suspect you've been infected, I am happy to share this toolkit with you, alongside a mitigation guide providing investigation steps and a remediation script for use after detection. r136a1.dev/2026/08/24/sleepw…

I just finished a 108-page whitepaper on a complex, air-gapped malware framework I found a while back. I'm calling it BeheMOF (you can check out the cover page below). I know a handful of other researchers are aware of this threat too. Getting my hands on a real, targeted APT framework like this (rather than the usual pseudo copy-and-paste stuff) is a dream for any malware researcher and it finally became a reality with this threat. The whitepaper is a complete technical analysis of this multi-stage malware framework, covering its infection chain, persistence mechanisms, lateral movement, exfiltration channels, detection opportunities and remediation procedures. Because several components were missing from the analyzed files, parts of the overall architecture remain unknown. The five-month analysis process was carried out as follows: - Phase 1 (3 Months): Pure manual reverse engineering. Extracted, decrypted, decompiled and formatted all multi-stage payloads, scripts and configurations to get a basic understanding of the malware. - Phase 2 (2 Months): AI-assisted analysis using Claude Code (Opus/Sonnet) and Gemini to map out the complex codebase relationships. My takeaways on using AI for malware analysis: When it did work, it was incredible helpful for understanding the malware's big picture, but it frequently hallucinated basic facts. The process started smoothly with Claude Opus 4.7, but requests were soon blocked by Anthropic's usage policies, even though the context was purely security research. Joining their Cyber Verification Program absolutely changed nothing, a problem that persisted when I tested Opus 4.8. Consequently, I shifted the analysis to Claude Sonnet 4.6 and later to Sonnet 5, which also triggered partial blocks. Thus, while AI is a powerful assistant for reverse engineering, almost every technical claim requires manual verification. Given how sensitive and targeted this malware is, dropping the report publicly isn't an option right now (even a hypothetical TLP:CLEAR version is completely off the table). However, I am open to sharing it with verified infosec peers (real identities only) in exchange for similar complex malware analysis. If you're interested, feel free to reach out via DM here or through the contact info on my website.

I released a new version of dotnetfile (v0.2.10) with fixes and improvements from several contributors (thank you!): github.com/pan-unit42/dotnet…