Slashdot

News for nerds, stuff that matters

Windows Backdoor 'Sleepwalker' Hides in Memory Until Activated by a 'Magic Packet'

"The Register has a story about a Windows backdoor that waits silently in memory for a 'magic packet' before springing into action," writes Slashdot reader fred133. "No outgoing traffic, just waiting..." From the report: Like a sleeper cell awaiting activation, a never-before-seen Windows backdoor dubbed Sleepwalker waits silently in memory for one specifically crafted network packet to wake it up and deliver commands using the malware's 23-instruction language. The commands can do everything from running code directly in memory to moving data off the computer. Malware researcher Dominik Reichel discovered the passive backdoor, which also has its own command language, and detailed Sleepwalker in a technical analysis on Monday. "What makes it worth writing up is what that packet carries: not a readable command, but a short program written in a command language of the backdoor's own design," Reichel said. "Its 23 instructions cover scheduling, several ways to move data, staged file delivery and running code directly in memory. Recovering the encryption key is not enough to understand one of these programs. The internal command language must be reverse engineered as well."

In addition to having its own command language, it's also notable that the remote host can be a VMware VMCI target instead of a normal network address. "Taken as a whole, the approach here is consistent with a targeted, well-resourced operation rather than an opportunistic one," Reichel wrote. The malware, hidden inside a 64-bit Windows DLL file, impersonates Microsoft's dpapi.dll, part of Windows' data protection API for protecting sensitive data. It exports the same seven functions as the real dpapi.dll, but attempts to forward calls to a file named dpapisvc.dll, which is not a real Windows component. The file also has a forged ESET Management Agent version resource, and loads via side-loading into ERAAgent.exe, the Windows executable for ESET Management Agent. After confirming that its host process is named ERAAgent.exe, Sleepwalker goes to sleep inside the computer's memory, which also helps it remain hidden from traditional anti-virus tools.

Unlike most backdoors, which call back to an attacker-controlled command-and-control (C2) server and start receiving commands, Sleepwalker lies in wait, checking every packet that passes through the network looking for a specific pattern - this is called a magic packet. Once it sniffs out a packet that matches the exact pattern, the backdoor decrypts the data and treats it as a command. "Because the backdoor never sends anything out on its own and does not open any obvious listening port by default, tools that watch for connections to known-bad domains or unusual outbound traffic will not see anything unusual," Reichel wrote. "The absence of outbound connections to known-bad infrastructure does not rule out an infection, either. A machine can be fully compromised by this backdoor while producing nothing at all for a network monitor to flag."

Read more of this story at Slashdot.

Formula 1 News

Formula 1® - The Official F1® Website

Gasly hails Alpine progress as Colapinto rues ‘harsh’ penalty

Pierre Gasly added points to Alpine's tally in an upgraded A526 at the Dutch Grand Prix, but it proved to be a tougher day for team mate Franco Colapinto.

Norris ‘driving at the level of a World Champion’ – Stella

Andrea Stella praised race-winner Lando Norris in the wake of the Dutch Grand Prix, which the McLaren man won from pole. But that does not tell the full story of the race, with Norris having to catch and pass Kimi Antonelli on track to ensure he took victory.

De Speld

Uw vaste prik voor betrouwbaar nieuws.

​Steeds meer politici verliezen vertrouwen in politiek

Politici hebben steeds minder vertrouwen in de politiek. Rob Jetten (39), een premier uit Den Haag: “Ze krijgen helemaal niets voor elkaar daar.”

“Ik voel me totaal niet gehoord door de mensen in Den Haag”, zegt Jesse Klaver. De partijleider van Pro is de afgelopen weken ‘compleet afgehaakt’ op ‘die hele poppenkast’. “Ze hebben geen idee wat er speelt in ons land. Hebben ze ooit wel eens echt met ons gesproken? Dat moeten dan onze vertegenwoordigers zijn.”

““Ik zou wel een keer een dagje willen meelopen om te zien waar ze het dan de hele dag over hebben”, zegt SGP-leider Stoffer. “Ik voel een enorme afstand tot de politiek. Die plucheplakkers moet weer gaan luisteren naar gewone politici.”

“Ik moet eerlijk zeggen: ik volg het allemaal niet meer”, zegt Joost Eerdmans van JA21: “Ik ga ook niet naar Prinsjesdag kijken, ik moet dan werken. Ze zoeken het maar uit met elkaar. Politiek is sowieso niet echt mijn ding.”

&


VK: Voorpagina

Volkskrant.nl biedt het laatste nieuws, opinie en achtergronden

Ouder brein gaat achteruit, maar niet als het om taal gaat

Rotterdam - FediMeteo (@rotterdam@nl.fedimeteo.com)

Weer voor de stad Rotterdam Deze bot wordt beheerd door het FediMeteo-project. Voor informatie en contact kunt u de pagina https://fedimeteo.com raadplegen.

Weer voor Rotterdam ☁️ - 25-08-2026 13:15 CEST...

Weer voor Rotterdam ☁️ - 25-08-2026 13:15 CEST

In één oogopslag:
• 21.6°C · Bewolkt ☁️ | Min 13.0°C / Max 24.3°C

Verwachting voor vandaag:
• Min 13.0°C, Max 24.3°C (Bewolkt) ☁️, 🧭 1014.1 hPa ➡️ 0.0 hPa/24h, Windsnelheid: 16.9 km/u (4.7 m/s), richting: ← 78°

Uurlijkse voorspelling voor de komende 12 uur:

14:00: 22.6°C (Zonnig) ☀️, 🧭 1014.2 hPa ➡️ 0.0 hPa/1h, Windsnelheid: 16.2 km/u (4.5 m/s), richting: ← 85°
15:00: 23.8°C (Zonnig) ☀️, 🧭 1013.9 hPa ➡️ 0.0 hPa/1h, Windsnelheid: 16.6 km/u (4.6 m/s), richting: ← 86°
16:00: 24.3°C (Bewolkt) ☁️, 🧭 1013.7 hPa ➡️ 0.0 hPa/1h, Windsnelheid: 16.9 km/u (4.7 m/s), richting: ← 91°
17:00: 24.1°C (Bewolkt) ☁️, 🧭 1013.7 hPa ➡️ 0.0 hPa/1h, Windsnelheid: 16.2 km/u (4.5 m/s), richting: ← 90°
18:00: 24.1°C (Bewolkt) ☁️, 🧭 1013.7 hPa ➡️ 0.0 hPa/1h, Windsnelheid: 16.2 km/u (4.5 m/s), richting: ← 83°
19:00: 23.8°C (Bewolkt) ☁️, 🧭 1013.6 hPa ➡️ 0.0 hPa/1h, Windsnelheid: 15.8 km/u (4.4 m/s), richting: ← 80°
20:00: 23.0°C (Bewolkt) ☁️, 🧭 1013.8 hPa ➡️ 0.0 hPa/1h, Windsnelheid: 13.7 km/u (3.8 m/s), richting: ← 81°
21:00: 21.9°C (Gedeeltelijk bewolkt) ☁️, 🧭 1014.2 hPa ➡️ 0.0 hPa/1h, Windsnelheid: 10.8 km/u (3.0 m/s), richting: ← 74°
22:00: 20.8°C (Helder) 🌕, 🧭 1014.8 hPa ↗️ +0.6 hPa/1h, Windsnelheid: 10.1 km/u (2.8 m/s), richting: ← 102°
23:00: 20.3°C (Helder) 🌕, 🧭 1015.1 hPa ➡️ 0.0 hPa/1h, Windsnelheid: 10.4 km/u (2.9 m/s), richting: ← 102°
00:00: 19.4°C (Helder) 🌕, 🧭 1015.1 hPa ➡️ 0.0 hPa/1h, Windsnelheid: 10.1 km/u (2.8 m/s), richting: ← 108°
01:00: 18.8°C (Helder) 🌕, 🧭 1015.1 hPa ➡️ 0.0 hPa/1h, Windsnelheid: 10.1 km/u (2.8 m/s), richting: ← 108°

Voorspelling voor de komende dagen:

woensdag 26 augustus: Min 16.7°C, Max 25.8°C (Bewolkt) ☁️, Kans op neerslag 1%, 🧭 1015.1 hPa ↗️ +1.0 hPa/24h, Windsnelheid: 15.8 km/u (4.4 m/s), richting: ← 96°
donderdag 27 augustus: Min 17.7°C, Max 25.5°C (Lichte onweersbui) ⛈️, Neerslag 12.1 mm, Kans op neerslag 22%, 🧭 1011.3 hPa ↘️ -3.8 hPa/24h, Windsnelheid: 20.5 km/u (5.7 m/s), richting: ↖ 150°
vrijdag 28 augustus: Min 16.2°C, Max 22.2°C (Lichte onweersbui) ⛈️, Neerslag 12.1 mm, Kans op neerslag 59%, 🧭 1008.0 hPa ↘️ -3.3 hPa/24h, Windsnelheid: 16.3 km/u (4.5 m/s), richting: ↗ 218°
zaterdag 29 augustus: Min 15.4°C, Max 21.5°C (Zware motregen) 🌦️, Neerslag 6.8 mm, Kans op neerslag 59%, 🧭 1008.7 hPa ↗️ +0.7 hPa/24h, Windsnelheid: 22.8 km/u (6.3 m/s), richting: ↗ 217°
zondag 30 augustus: Min 16.8°C, Max 21.6°C (Matige motregen) 🌦️, Neerslag 3.8 mm, Kans op neerslag 56%, 🧭 1008.8 hPa ➡️ 0.0 hPa/24h, Windsnelheid: 22.0 km/u (6.1 m/s), richting: ↗ 222°
maandag 31 augustus: Min 15.8°C, Max 19.7°C (Lichte motregen) 🌦️, Neerslag 1.8 mm, Kans op neerslag 68%, 🧭 1010.0 hPa ↗️ +1.2 hPa/24h, Windsnelheid: 23.8 km/u (6.6 m/s), richting: ↗ 232°

Details:
• 🌡️ Huidige temperatuur (om 13:15): 21.6°C (Bewolkt)
• 🤚 Gevoelstemperatuur: 21.5°C (-0.1°C)
• 💨 Windsnelheid: 15.5 km/u (4.3 m/s), richting: ← 87°
• 🌬️ Windstoten: 34.2 km/h (9.5 m/s)
• 💧 Luchtvochtigheid: 48%
• 🧭 Luchtdruk: 1014.2 hPa ↘️ -0.5 hPa/3h
• 👁️ Zichtbaarheid: 32.0 km
• ☀️ UV-index: 5.2
• 🌅 Zonsopgang: 06:43 · 🌇 Zonsondergang: 20:45

Luchtkwaliteit:
• AQI: 44 🟢 (Goed)
• PM2.5: 9.4 μg/m³
• PM10: 13.8 μg/m³

Gegevens geleverd door Open-Meteo



The Guardian

Latest news, sport, business, comment, analysis and reviews from the Guardian, the world's leading liberal voice

Burnham to take Zelenskyy’s pleas for Patriot missiles to Trump – Europe live

UK PM to join delegation of leaders lobbying US president to step up supplies

Vatican envoy Paul Gallagher met Russian foreign minister Sergei Lavrov in Moscow earlier today, and Reuters has some snap quotes from Pope Leo XIV’s representative following the meeting. He is quoted as saying that “The Ukrainian war must end” and that the pair discussed “avenues for pursuing lasting and just peace in Ukraine”.

In relation to the post on a US military plane landing in Moscow (at 11:23), Reuters reported that the last time a US jet flew to Russia from Europe was in ​January, when special envoys Steve Witkoff and Jared Kushner travelled to Moscow to meet Vladimir Putin for peace talks.

Continue reading...

USS Abraham Lincoln to dock in Thailand next week after record Middle East deployment – US politics live

Ship has not made a port call for more than 200 days and there have been reports of low morale and poor mental health amid food and water shortages

The Kremlin said it had no information ‌on a US military ⁠transport plane landed at Moscow’s Vnukovo airport earlier today, data from ⁠the flight tracking service ⁠Flightradar24 ​showed.

The large Boeing Globemaster had flown direct from Riga, in Latvia, and landed in Moscow at ⁠around 7am GMT, Reuters reports. The news agency was unable to verify ​whether it ‌carried any cargo ‌or passengers.

Continue reading...

Russian stadium says it will not host Kanye concerts – but promoter says shows have not been cancelled

The controversial rapper now known as Ye was due to play two huge shows at St Petersburg’s Gazprom Arena, which now states it cannot host performances for contractual reasons

The St Petersburg stadium that was set to host two concerts by Ye – making the rapper formerly known as Kanye West the biggest western act to play in Russia since start of the Ukraine war – has now said that the concerts will not take place at the venue, although the promoter has stressed that they have not been cancelled.

Gazprom Arena had previously posted on social media saying that “the most influential musical artist of our time” would perform there on 10 and 11 October. “This is no joke!” the post stated. The event sold out immediately, including tickets priced at £1390 ($1896).

Continue reading...

The Moscow Times - Independent News From Russia

The Moscow Times offers everything you need to know about Russia: Breaking news, top stories, business, analysis, opinion, multimedia

Fire at Amur Gas Chemical Complex Kills Chinese Worker, Injures Over 100

The Amur Gas Chemical Complex is a $10 billion joint venture between Russian petrochemical giant Sibur and China’s state-owned oil and gas company Sinopec.