Cybersecurity researchers have uncovered a sophisticated phishing campaign deploying the Sirius Backdoor malware through fake FedEx tax invoices. This deceptive tactic targets individuals responsible for handling bills and payments, primarily through emails written in Korean with urgent subject lines about an impending tax invoice. The malware cleverly conceals its payload within a blank PDF, executing its code in memory, which makes it difficult to detect as it leaves minimal traces on the hard drive.
The Trellix Threat Response Team discovered this threat while investigating an unexpected PDF activity on a client's system. Their findings revealed a multistage attack that utilizes a ZIP archive, named Fedex_tax_receipt.zip, to deliver the malware. Upon opening the seemingly innocuous PDF, hidden commands initiate a PowerShell script that decrypts and executes the malicious code directly in memory. This method bypasses traditional antivirus defenses by not downloading executable files to the disk.
The Sirius Backdoor employs advanced techniques to evade detection, such as patching Windows Event Tracing to blind security tools and using Early Bird APC injection to hide within trusted processes. Additionally, it ensures persistence by dropping a provisioning package or writing scripts to initiate during system startup. Once active, the backdoor grants attackers extensive control over the infected system, including accessing webcams, stealing credentials, and altering cryptocurrency wallet addresses.
Experts recommend several defensive measures, including enabling specific Microsoft Defender rules and closely monitoring suspicious process chains. Understanding the tactics used in this campaign can help organizations better protect themselves from similar threats.
