Sleepwalker is a 64‑bit unsigned Windows DLL that does not initiate network traffic on its own. The file copies the version information of Microsoft’s dpapi.dll and is loaded beside ESET Management Agent’s ERAgent.exe through DLL side‑loading. It remains dormant until a network packet that satisfies a checksum, length and encryption test is received. When the packet is validated, the DLL decrypts a command and runs a custom bytecode interpreter that supports up to 23 instructions for scheduling, data transfer via TCP, UDP, ICMP, SMB named pipes, VMware VMCI, and raw promiscuous sniffing, as well as staged file delivery, in‑memory execution and encrypted command transmission. The backdoor modifies Windows security settings to allow unauthenticated access to named pipes and uses a statically linked copy of mbedTLS for encryption. No outbound connections are made; the operator delivers commands via the trigger packet, which may appear in ordinary traffic, including crafted DNS queries. Two detection tools have been released: a YARA rule that matches the file’s hash, version‑resource claims and the AES key used for authenticated payloads, and a PowerShell scanner that checks for the DLL beside ERAgent.exe, the known SHA‑256 hash, the dpapisvc.dll companion, and registry settings that allow anonymous SMB access and null session pipes.