New SLEEPWALKER Backdoor Waits for One Crafted Packet, Then Runs Its Own Bytecode

An independent malware researcher documented a previously unreported Windows backdoor named SLEEPWALKER. It stays inert in memory until a specifically crafted network packet reaches the machine, then runs commands written in a 23-instruction language of its own design. The sample is an unsigned 64-bit Windows DLL of 59,904 bytes, built to be side-loaded into a legitimate process.