Sirius Backdoor Hides Behind Fake FedEx Invoices
A Korean-language spear-phishing campaign posing as a FedEx tax invoice is delivering a previously undocumented variant of the Sirius Backdoor. The email carries a ZIP archive holding a visually blank PDF that abuses the objects to spawn a hidden PowerShell command the moment it is opened.
Summary
- First Seen
- 2026
- Targeted Regions
- South Korea (primary); the backdoor also accepts victims in roughly 88 other countries, including the United States, Canada, Australia, and European nations
- Targeted Platform
- Windows
- Targeted Industries
- Corporate finance, billing and accounting functions
- Malware
- Sirius Backdoor
A Korean-language spear-phishing campaign posing as a FedEx tax invoice is delivering a previously undocumented variant of the Sirius Backdoor. The email carries a ZIP archive holding a visually blank PDF that abuses the objects to spawn a hidden PowerShell command the moment it is opened. From there, the infection stays entirely in memory, chaining AES decryption, Gzip decompression, RC4, and a byte de-interleaving trick to rebuild each stage without ever writing a clean executable to disk. The resulting VC++ backdoor gives operators hidden desktop control, SOCKS5 pivoting, webcam and microphone capture, browser credential theft, clipboard cryptocurrency hijacking, and persistence designed to survive a full Windows reset.
Attack Details
The attack starts with a Korean-language phishing email posing as a FedEx tax invoice. It quotes an invoice number and a 217,740 KRW payment that is almost due, which pushes billing and accounting staff to open the attachment quickly. The attachment is a ZIP file, Fedex_tax_receipt.zip, which hides the payload from basic gateway scanners. Inside is Fedex_tax_receipt.pdf, and it opens as a blank page. That is deliberate, because the file exists only to run code. Its /OpenAction and /Launch objects quietly start PowerShell with a hidden window and a Base64-encoded script. The victim still has to click through the PDF reader's security prompt, so the chain depends on one last moment of trust.
From that point, nothing readable is written to disk. The PowerShell script decrypts an AES-encrypted, GZip-compressed block in memory and loads it as a .NET assembly. That first loader unpacks the next stage by deriving an RC4 key with SHA256 and then keeping only every third byte of the decrypted data, discarding the junk in between so scanners cannot spot an MZ header. The second stage is the injector. It patches ntdll!EtwEventWrite with a no-op, cutting off the Event Tracing for Windows feed that most EDR tools depend on, then downloads the final payload, zeus.dat, from dubaitechnicalservice.ae and injects it into msbuild.exe or svchost.exe using Early Bird APC injection.
Sirius is built to stay. Depending on its configuration, it writes an HKCU Run key, registers a scheduled task that fires at logon with the highest available privileges, or hides itself with system and hidden file attributes. With admin rights, it goes further, editing the default user hive. Hence, every new account on the machine inherits the infection, dropping a provisioning package in C:\Recovery\Customizations. Hence, it returns even after a Windows reset, and writes SetupComplete.cmd to run as SYSTEM during setup. Without admin rights, it drops updater.vbs into the Startup folder and sets a compatibility flag that prompts for elevation later. Instead of moving sideways through the network, it profiles the host (hardware ID, CPU, RAM, Defender status, idle time) to judge whether it has landed on a real workstation or a sandbox, then opens a SOCKS5 relay and a hidden desktop session for the operator.
Everything it collects goes back over the backdoor’s own channel, a raw TCP connection to 185[.]114[.]206[.]45 on port 4449 with a fallback server listed in its config. It includes saved Chromium passwords, cookies, autofill data, keystrokes, clipboard contents, and live webcam, microphone, and speaker audio. A built-in clipper watches the clipboard for Bitcoin, Ethereum, and Monero addresses and swaps in the attacker's wallet at the moment of payment. To protect itself, Sirius adds Defender exclusions, changes firewall rules, and deletes Volume Shadow Copies so local recovery is harder.
Recommendations
- 01Block PDF Readers From Spawning Child ProcessesEnable the Microsoft Defender attack surface reduction rule that blocks Adobe Reader from creating child processes (GUID 7674ba52-37eb-4a4f-a9a1-f0f9a1619a2c). This breaks the /Launch chain at its first step, before PowerShell ever starts.
- 02Constrain PowerShell Through CLMEnforce PowerShell Constrained Language Mode via AppLocker or WDAC. Fileless loaders of this type depend on dynamic .NET and reflection operations, and CLM removes the exact capabilities they rely on.
- 03Turn On Script Block LoggingEnable PowerShell Script Block Logging and alert on Event ID 4104. Because the malicious script is Base64-encoded and decrypted in memory, script block logging is one of the few places the reconstructed code becomes visible.
- 04Hunt for Suspicious Process LineageAlert on a PDF reader launching powershell.exe, script engines launching msbuild.exe, or unexpected parents creating svchost.exe. These relationships are rare in normal operations and map directly to this chain.
- 05Detect Early Bird APC InjectionWatch for processes created with CREATE_SUSPENDED followed by cross-process memory writes, NtQueueApcThread calls and thread resumption. This pattern is the signature of the injection step used to launch the backdoor.
- 06Monitor ETW TamperingTreat in-memory modification of ntdll!EtwEventWrite as high severity, and corroborate endpoint telemetry with network and identity sources so a blinded ETW stream does not translate into a blind SOC.
- 07Audit Uncommon Persistence LocationsRegularly check for unexpected .ppkg files under C:\Recovery\Customizations, SetupComplete.cmd in C:\Windows\Setup\Scripts, UserInitMgrLogonScriptName under HKCU\Environment, BootExecute additions under Session Manager, and RUNASADMIN entries in AppCompatFlags\Layers. These survive reimaging and routine cleanup.
- 08Review Defender Exclusions and Shadow CopiesAlert whenever Windows Defender exclusions are added programmatically and whenever Volume Shadow Copies are deleted. Both are post-compromise actions here, not administrative noise.
Indicators of Compromise (IoCs)
| Type | Value |
|---|---|
| MD5 | 3cc5147d1dbe295c63da958afadac6c66ffcf5f7aa4b3b75b06bd7a7f49366a839993389e1e95ebbd55aa54058cf7b5264a9940fc78de8a895d968a4092ed10b62A458EB260E7AA26092DBDF9C2D8ED4e8b080c276519547e95930ab15028adb |
| SHA256 | 87aafaa8bb6444bae4d2ef82e395c46e85daf468a66754169b1e3d762ba04f517ec38100faffb910ece1f379cb93ec09cc2beeb35ee8bdb401d7645469dca1056da827caff789c1c33dd9ad380c610541f6dd90678db527c4f5bdf5012e305d4899fc5fae0593dd47aef9db4b51ffb5aeae27be9d1b6beb41108411baca7ef05eedd60c6abfc4c18578c960ae55b177ea9ff14e8d41634c46f361cc8680df01cd6802fce5b918ed247ba85d6aa0545a8120cfbc3734b1c37794c4e381862d4ee |
| URL | hxxps[:]//dubaitechnicalservice[.]ae/prood/zeus[.]dat |
| Domain | dubaitechnicalservice[.]ae |
| IPv4:Port | 185[.]114[.]206[.]45[:]4449 |
MITRE ATT&CK TTPs
References & Patch Links
References
What Next?
At Hive Pro, it is our mission to detect the most likely threats to your organization and to help you prevent them from happening.
.svg)