ERAAgent.exe using VMware VMCI/AF_VSOCK for covert C2 (SLEEPWALKER)

Arnold Chan@slaz

•updated Sep 7, 2026•0•0•1

Detects the ESET Management Agent (ERAAgent.exe) initiating outbound network connections using non-standard socket families, specifically AF_VSOCK (virtual socket) or VMCI (Virtual Machine Communication Interface). These interfaces are typically used for inter-process communication between a host and a guest virtual machine, or between guest virtual machines, and may indicate malicious activity such as lateral movement from a virtualized environment, virtual machine escape attempts, or unauthorized communication within an ESXi host environment.