Fake FedEx Tax Invoice PDFs Deliver Fileless Sirius Backdoor to Windows Systems
Do Son 
Infection chain | Image: Trellix Threat Response Team
TL;DR
The Trellix Threat Response Team uncovered a multistage attack that uses fake FedEx tax invoices in Korean to deploy the Sirius Backdoor. Inside an attached ZIP archive, a blank PDF triggers an in-memory PowerShell chain that blinds endpoint sensors and hollows legitimate Windows processes. Furthermore, this fileless Sirius Backdoor drops a custom Windows provisioning package so the malware can survive a full operating system reset.
Delivery and Attribution
The investigation began during a priority customer incident involving an unexpected PDF process alert. Attackers initiated the breach by sending a Korean-language spear-phishing email pretending to come from FedEx Billing Online. The message referenced invoice number 724156148 and demanded payment of 217,740 South Korean Won before a strict deadline. To slip past email gateway scanners, the sender attached a 205-kilobyte ZIP archive named Fedex_tax_receipt.zip containing a malicious PDF file.
Confirmed Versus Suspected Attribution
Confirmed attribution to a specific threat actor or nation-state group does not exist for this campaign. However, technical artifacts inside the payload show a confirmed tool link to the commercial SiriusQT malware family documented by Group-IB. Specifically, both implants read settings from a resource named Caffee_Config or a memory marker labeled SIRIUS_STUB_CONFIG. Therefore, suspected attribution points to an affiliate who bought or obtained a builder for this RAT family and paired it with a custom crypter chain. While Trellix investigated one corporate escalation in South Korea, the backdoor’s internal geofence list permits execution across roughly 88 countries, including the United States, Canada, Australia, and European nations.
Infection Chain
When a victim opens Fedex_tax_receipt.pdf, the document displays a single blank space character. In the background, the file uses PDF /OpenAction and /Launch tags to invoke a hidden PowerShell window. According to the Trellix Threat Response Team report, “Analysis revealed that the PDF abuses /OpenAction and /Launch objects to trigger an embedded Base64-encoded PowerShell command upon opening. Execution relies on social engineering to trick the user into approving the PDF reader’s security confirmation prompt.”
De-Interleaving and Telemetry Blinding
Once approved, the PowerShell stager decrypts an embedded byte array using AES-256 in CBC mode, decompresses the output via GZip, and loads the Stage 1 .NET loader directly into memory. Next, the Stage 1 loader hashes an XOR-masked byte array with SHA-256 to derive an RC4 decryption key. After RC4 decryption, the loader reconstructs the Stage 2 injector using a 3-to-1 byte de-interleaving loop that keeps every third byte and discards the remaining 66 percent of random junk bytes. This step hides the executable MZ header from memory scanners until the moment of reflective invocation.
Before fetching the final payload, the Stage 2 injector disables host telemetry. It hooks the EtwEventWrite and NtManageHotPatch functions inside ntdll.dll and replaces them with no-operation instructions. As the researchers noted, “Any malicious activity performed after this point – such as process injection or credential theft – will not be logged by Windows, effectively making the malware “invisible” to security sensors.”
Early Bird APC Process Hollowing
Subsequently, the injector decrypts an RC4-encoded URL pointing to a command server hosted on a United Arab Emirates domain and downloads a binary file named zeus.dat. Because this final payload is a native Visual C++ binary rather than a .NET assembly, the injector selects a trusted Windows binary from a list of 24 executables, including msbuild.exe and svchost.exe. It spawns the host process in a suspended state, unmaps its memory, writes the Sirius Backdoor into the hollow space, and runs it via an Early Bird asynchronous procedure call using NtQueueApcThread.
Command-and-Control and Data-Exfiltration Behavior
Once running inside the hollowed process, the fileless Sirius Backdoor adjusts its display scaling awareness so screenshots remain sharp on high-resolution monitors. Next, it parses its 128-byte configuration block, which points to an external command server over TCP port 4449. As Broadcom Symantec analysts also noted in their protection bulletin, the implant profiles the host by combining the volume serial number and NetBIOS name into a hardware ID, checks Windows Defender settings, steals Chromium browser logins, logs keystrokes, records webcam and microphone streams, and swaps cryptocurrency addresses in the clipboard.
Multi-Tier Persistence and Reset Survival
Controlled by two bitmask flags, the Sirius Backdoor supports an aggressive persistence matrix. At the user level, it can create Registry Run keys, scheduled tasks, Startup folder shortcuts, or a UserInitMprLogonScript batch script. If the implant lacked administrator rights, it drops a Visual Basic script and sets the RUNASADMIN compatibility flag to trigger a User Account Control prompt.
When running with administrator privileges, the malware executes three deep survival routines. First, it mounts the Default User registry hive (NTUSER.DAT) so every future Windows account inherits the autorun entry. Second, it writes a custom Windows provisioning package (.ppkg) into the C:\Recovery\Customizations folder so Windows Push-Button Reset reinstalls the backdoor during a full system recovery. Third, it drops a SetupComplete.cmd script to regain SYSTEM privileges after any Windows operating system upgrade.
Defense and Detection Guidance
Because the fileless Sirius Backdoor disables Event Tracing for Windows only after Stage 2 loads, defenders should focus detection on the initial document trigger. Security teams should flag any PDF reader process spawning powershell.exe with hidden window or encoded command flags. Administrators can also disable the option to allow external program launches inside enterprise PDF reader group policies.
On the endpoint, threat hunters should audit the C:\Recovery\Customizations directory for unauthorized .ppkg files, check C:\Windows\Setup\Scripts for rogue SetupComplete.cmd scripts, and inspect the Default User registry hive for unexpected Run entries pointing to svchost.exe inside AppData or Temp folders. Finally, network defenders should block outbound traffic to unverified UAE staging domains and monitor for connections on non-standard ports such as TCP 4449.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
