{
  "id": 3161519,
  "title": "You don't want this Sleepwalker backdoor on your Windows machine",
  "url": "https://urgent.news/2026/08/24/you-dont-want-this-sleepwalker-backdoor-on-your-windows-machine",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-24T21:39:39.000Z",
  "source": {
    "name": "The Register Science",
    "slug": "the-register-science",
    "url": "https://www.theregister.com/security/2026/08/24/you-dont-want-this-sleepwalker-backdoor-on-your-windows-machine/5292021"
  },
  "original_language": "en",
  "account": "A newly discovered backdoor called Sleepwalker poses a significant threat to Windows machines. Discovered by malware researcher Dominik Reichel, Sleepwalker remains hidden in memory until triggered by a specific network packet, which activates the malware to execute 23 discreet instructions. Unlike traditional backdoors, Sleepwalker does not initiate outbound communication, making it difficult for network monitors to detect. The backdoor's unique command language consists of 23 instructions, each represented as raw bytes in a specific order. Its malicious activities include data exfiltration, file staging, code execution in memory, and establishing connections to VMware VMCI targets. The malware masquerades as Microsoft's dpapi.dll, exports seven functions, and employs encryption using AES-256-CCM. Despite the limited information available about its origin, Sleepwalker demonstrates the potential for targeted, well-resourced operations.",
  "summary": "Its own command language, 23 instructions - signs point to 'well-resourced operation rather than an opportunistic one'",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 2,
    "also_reported_by": [
      {
        "outlet": "The Register",
        "title": "You don't want this Sleepwalker backdoor on your Windows machine",
        "url": "https://urgent.news/2026/08/24/you-dont-want-this-sleepwalker-backdoor-on-your-windows-machine-3165343",
        "published": "2026-08-24T21:39:39.000Z"
      }
    ]
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}