SLEEPWALKER is a passive backdoor that activates when the host process carries the name ERAAgent.exe, and it never contacts a fixed C2 address. It uses six transports including DNS triggering, VMCI, ICMP, named pipes and TCP/UDP connections to deliver commands over the network. The malware has 23 instructions covering scheduling, staged file delivery with SHA-256 verification and in-memory execution.