Newly SLEEPWALKER Backdoor Waits for One Crafted Packet, Then Runs Its Own Bytecode

A newly documented Windows backdoor named SLEEPWALKER remains inert in memory until it receives a specifically crafted network packet, then executes commands in a custom 23-instruction language. The unsigned 64-bit DLL is 59,904 bytes and is designed for side-loading, according to an independent malware researcher's findings.