Hackers Use Fake FedEx Invoices to Deploy Sirius Backdoor and Evade Windows Security
A new campaign uses fake FedEx tax invoices to deliver the Sirius Backdoor malware on Windows systems, employing sophisticated evasion techniques to bypass security defenses.
Cybercriminals are employing a sophisticated phishing campaign that leverages fake FedEx tax invoices to deliver a stealthy backdoor malware known as Sirius Backdoor onto Windows systems. The emails, written in Korean and bearing the subject line "FedEx A tax invoice has been issued," target individuals responsible for handling bills and payments. They create a sense of urgency by claiming a tax invoice of 217,740 KRW is due, prompting recipients to open a malicious attachment.
The campaign's initial payload is concealed within a ZIP archive named Fedex_tax_receipt.zip, which contains a PDF file named Fedex_tax_receipt.pdf. This PDF appears blank but is designed to execute malicious code upon opening. The attack relies on tricking the user into approving a security prompt from their PDF reader, which then triggers a PowerShell command. This command does not download an executable file but instead decrypts an AES-encrypted, GZip-compressed block directly in memory, loading it as a .NET assembly.
Further stages of the infection process are designed for maximum stealth and evasion. The second-stage injector attempts to blind endpoint detection and response (EDR) products by patching Event Tracing for Windows (ETW) in the ntdll.dll library, thereby cutting off a critical data source for security tools. The final payload, identified as zeus.dat, is then downloaded from a compromised domain and injected into trusted processes such as msbuild.exe or svchost.exe using a technique called Early Bird APC injection.
Sirius Backdoor exhibits advanced persistence mechanisms, designed to survive reboots and even system resets. If the malware gains administrative privileges, it establishes persistence by dropping a provisioning package into C:\Recovery\Customizations and creating a SetupComplete.cmd script that executes with SYSTEM rights during Windows setup. In environments without administrative rights, it writes an updater.vbs script to the Startup folder and prompts the user for elevation, or it may copy itself to System32 as user32.dll for DLL side-loading.
Once established, the Sirius Backdoor grants operators extensive control over the compromised system. This includes the ability to open hidden desktops, utilize an embedded SOCKS5 proxy for anonymized network traffic, capture webcam and microphone feeds, steal credentials from Chromium-based browsers, and even swap cryptocurrency wallet addresses in the clipboard to redirect funds. The malware also takes steps to further evade detection by adding exclusions to Microsoft Defender and deleting Volume Shadow Copies, making forensic analysis more difficult.
Researchers at Trellix, who identified this campaign, recommend several security measures to mitigate the threat. These include enabling Microsoft Defender's Attack Surface Reduction (ASR) rule that blocks Adobe Reader from creating child processes, enforcing PowerShell Constrained Language Mode, and enabling Script Block Logging to monitor Event ID 4104 for suspicious activity. Security teams are also advised to flag unusual process chains, such as a PDF reader launching PowerShell, and to review Defender exclusions and scheduled tasks for any anomalies.
The techniques employed by the Sirius Backdoor campaign highlight a growing trend in malware development, focusing on in-memory execution, advanced evasion tactics, and sophisticated persistence methods to bypass modern security defenses. The use of legitimate-looking invoices and trusted brands like FedEx underscores the continued effectiveness of social engineering in initial access, while the multi-stage, heavily obfuscated payload demonstrates the increasing technical sophistication of threat actors.