Threat reportMalwareTL-2026-4540
New Sirius Backdoor Variant Delivered via Korean-Language FedEx Tax Invoice Phishing, Uses Fileless .NET Loading and Early Bird APC Injection into msbuild.exe/svchost.exe
New Sirius Backdoor Variant Delivered via Korean-Language (TL-2026-4540), also tracked as Sirius backdoor Korean FedEx campaign, is a high-severity malware campaign, first published 2026-10-27. It has no confirmed attribution, affects Microsoft Windows (endpoints with PowerShell and .NET), maps to 25 MITRE ATT&CK techniques (T1027, T1027.013, T1053.005), and is covered by 9 detection rules and 24 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 25MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 24Indicators of compromise
Key facts for TL-2026-4540
- Threat ID
- TL-2026-4540
- Also known as
- Sirius backdoor Korean FedEx campaign
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- corporate, finance-accounting, logistics-themed-lure
- Target regions
- south korea
- Detection rules
- 9
- Indicators of compromise
- 24
- Updates
- 2026-10-27 · revalidated 1× · latest source
Malware and tooling in New Sirius Backdoor Variant Delivered via Korean-Language
Malware and tooling: Sirius backdoor
How New Sirius Backdoor Variant Delivered via Korean-Language works
Trellix documents a Sirius backdoor variant delivered through Korean-language phishing emails posing as FedEx tax invoices (217,740 KRW). A weaponized PDF launches hidden PowerShell that reflectively loads .NET stages in memory, patches ETW/hot-patch telemetry, and injects the backdoor into legitimate Windows processes via process hollowing with Early Bird APC injection.
A previously undocumented variant of the Sirius backdoor is being delivered in a geo-targeted, Korean-language spear-phishing campaign. The email, titled "[FedEx] A tax invoice has been issued", cites an invoice fee of 217,740 KRW and attaches Fedex_tax_receipt.zip, which contains Fedex_tax_receipt.pdf. The PDF renders a blank page; behind it, /OpenAction and /Launch objects invoke PowerShell with a hidden window and execution-policy bypass. Per the hunt analysis, opening the PDF alone is not sufficient: the victim must approve a PDF-reader security prompt before the launch action runs.
The PowerShell stage is Base64-encoded and decrypts an embedded blob with AES-CBC, then GZip-decompresses it into a .NET assembly that is loaded reflectively (fileless). Later layers use RC4 with a key derived through XOR and SHA-256 hashing, and an every-third-byte extraction routine to rebuild executable headers. Before the payload runs, the loader patches EtwEventWrite and NtManageHotPatch to blind Windows event tracing. A secondary payload, zeus.dat, is fetched (the report ties the delivery to dubaitechnicalservice.ae) and contains the Sirius backdoor. Later loaders create a legitimate process (msbuild.exe or svchost.exe) in a suspended state, hollow it, and use Early Bird APC injection so the backdoor executes inside the trusted process.
The backdoor config is identifiable via a Caffee_Config resource or a SIRIUS_STUB_CONFIG in-memory marker; behavior flags enable mutex checks, hidden file attributes and geographic restrictions. Persistence is achieved through registry Run entries, scheduled tasks, startup shortcuts and default-profile modifications. The C2 endpoint reported is 185.114.206.45:4449. Secondary-source summaries of the Trellix report (TechNadu, via search snippet; the page itself could not be fetched) attribute HVNC, SOCKS5 pivoting, Chromium credential harvesting and cryptocurrency wallet substitution to this Sirius variant. The GBHackers article states its own analysis does not establish specific password-extraction capabilities despite its headline, so credential theft should be treated as reported by secondary summaries, not independently confirmed here.
Analyst notes: no threat actor is named in the sources. The GBHackers article labels Early Bird injection as T1134.005, T1562.008 for ETW patching and T1027.010 for fileless execution; those IDs do not match the behaviors (T1134.005 is SID-History Injection, T1562.008 is cloud log impairment), so this record maps them to T1055.004, T1562.006 and T1620. The unrelated-by-evidence 'SiriusQT' RAT reported by Group-IB shares a name only; no source links it to this campaign. The Trellix primary page returned HTTP 403 to the harness, BeaconBeagle has no record for the C2 IP (HTTP 404) and no config match for the domain (empty result set); IOCs here come from the GBHackers reproduction of the Trellix indicators.
MITRE ATT&CK techniques used in TL-2026-4540
Defense Evasion
T1027 Obfuscated Files or Information; T1027.013 Encrypted/Encoded File; T1055.004 Asynchronous Procedure Call; T1055.012 Process Hollowing; T1140 Deobfuscate/Decode Files or Information; T1480 Execution Guardrails; T1562.001 Impair Defenses; T1564.001 Hidden Files and Directories; T1620 Reflective Code Loading
Persistence
T1053.005 Scheduled Task; T1547.001 Registry Run Keys / Startup Folder; T1547.009 Shortcut Modification; T1574.002 Hijack Execution Flow
Execution
T1059.001 PowerShell; T1204.002 Malicious File
Command and Control
T1090 Proxy; T1105 Ingress Tool Transfer; T1219 Remote Access Tools
Collection
T1115 Clipboard Data; T1123 Audio Capture; T1125 Video Capture
Impact
Credential Access
T1555.003 Credentials from Web Browsers
Initial Access
T1566.001 Spearphishing Attachment
defense-impairment
Affected products and versions in New Sirius Backdoor Variant Delivered via Korean-Language
- Microsoft — Windows (endpoints with PowerShell and .NET)
Vulnerable versions: Windows endpoints where a user approves the PDF reader launch prompt
Remediation for New Sirius Backdoor Variant Delivered via Korean-Language
Immediate actions
- Block 185.114.206.45 (TCP/4449) and dubaitechnicalservice.ae at the perimeter and DNS layers
- Hunt mail gateways and endpoints for Fedex_tax_receipt.zip / Fedex_tax_receipt.pdf and the published MD5/SHA-256 hashes
- Quarantine messages with subject '[FedEx] A tax invoice has been issued' and reset credentials on any host where the PDF launch prompt was approved
- Hunt for msbuild.exe or svchost.exe with unusual parentage, network connections to 185.114.206.45, or created suspended then resumed via APC
Workarounds
- Block ZIP attachments containing PDFs from external senders or detonate them in a sandbox
- Use Constrained Language Mode / WDAC to limit reflective .NET loading from PowerShell
Longer-term hardening
- Disable PDF reader launch actions and JavaScript/OpenAction execution by policy; train users that PDF security prompts must not be approved
- Enable PowerShell Script Block, Module and Transcription logging and AMSI; alert on hidden-window, ExecutionPolicy Bypass and Base64 command lines spawned by PDF readers
- Deploy EDR with behavioral coverage for Early Bird APC injection, process hollowing and ETW tampering (EtwEventWrite/NtManageHotPatch patching)
- Constrain msbuild.exe execution to build servers and restrict outbound traffic from server/system processes
Timeline of New Sirius Backdoor Variant Delivered via Korean-Language
- Hashes for the email, ZIP, PDF, .NET loader, .NET injector and Sirius payload published with C2 185.114.206.45:4449 and the zeus.dat payload URL on dubaitechnicalservice.ae (per Cyber Security News relay of the Trellix report).
- Cyber Security News relay details privilege-dependent persistence (provisioning package and SetupComplete.cmd as admin; updater.vbs or user32.dll sideloading as standard user) and capabilities including webcam/mic capture, Defender exclusions and Volume Shadow Copy deletion.
- GBHackers and TechNadu publish coverage of the Trellix findings; Threadlinqs opens TL-2026-4540.
- Report documents persistence through registry Run entries, scheduled tasks, startup shortcuts and default-profile modifications.
- Report documents download of zeus.dat (Sirius backdoor) and process hollowing with Early Bird APC injection into suspended msbuild.exe or svchost.exe; C2 at 185.114.206.45:4449.
- Report documents the PDF /OpenAction and /Launch chain invoking hidden Base64 PowerShell (ExecutionPolicy Bypass) after the victim approves a reader prompt; AES-CBC/GZip/RC4 layers reflectively load .NET stages and patch EtwEventWrite and NtManageHotPatch.
- Report documents the lure email '[FedEx] A tax invoice has been issued' (217,740 KRW) carrying Fedex_tax_receipt.zip with Fedex_tax_receipt.pdf.
- Trellix Research publishes analysis of a new Sirius backdoor variant spread by Korean-language FedEx tax-invoice phishing; in-the-wild campaign dates are not stated in the available sources.
Update history for TL-2026-4540
- 2026-10-27 — Fake FedEx Tax Invoice Phishing Campaign Delivers Sirius Backdoor via Weaponized PDF: What changed No field escalation warranted: severity HIGH, exploitability ACTIVE and status ACTIVE already match the newer report; attribution remains unattributed/LOW. New indicators (11) 1 payload URL, 6 stage hashes (stage 1 loader, stag
Sources cited for New Sirius Backdoor Variant Delivered via Korean-Language
- Trellix Research: Sirius backdoor fileless campaign using FedEx invoices
- New Sirius Backdoor Hides Inside Windows Processes to Steal Passwords and Evade Detection (GBHackers)
- Sirius Backdoor Campaign Hides Fileless Malware in Spear-Phishing Emails Containing Fake FedEx Tax Invoices (TechNadu)
- Early Bird code injection technique background (The Hacker News)
- Group-IB: SiriusQT RAT/HVNC stealer (name-similar malware, not linked to this campaign by any source)
Detection coverage for TL-2026-4540
As of 2026-10-27, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4540 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.