# New Sirius Backdoor Variant Delivered via Korean-Language FedEx Tax Invoice Phishing, Uses Fileless .NET Loading and Early Bird APC Injection into msbuild.exe/svchost.exe

> Trellix documents a Sirius backdoor variant delivered through Korean-language phishing emails posing as FedEx tax invoices (217,740 KRW). A weaponized PDF launches hidden PowerShell that reflectively loads .NET stages in memory, patches ETW/hot-patch telemetry, and injects the backdoor into legitimate Windows processes via process hollowing with Early Bird APC injection.

- **Published:** 2026-10-27T13:47:57Z
- **Last reviewed:** 2026-10-27T15:09:06.286Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4540
- **ID:** TL-2026-4540
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 24 (full data via the Threadlinqs MCP server — Purple tier)

## Description

A previously undocumented variant of the Sirius backdoor is being delivered in a geo-targeted, Korean-language spear-phishing campaign. The email, titled "[FedEx] A tax invoice has been issued", cites an invoice fee of 217,740 KRW and attaches Fedex_tax_receipt.zip, which contains Fedex_tax_receipt.pdf. The PDF renders a blank page; behind it, /OpenAction and /Launch objects invoke PowerShell with a hidden window and execution-policy bypass. Per the hunt analysis, opening the PDF alone is not sufficient: the victim must approve a PDF-reader security prompt before the launch action runs.

The PowerShell stage is Base64-encoded and decrypts an embedded blob with AES-CBC, then GZip-decompresses it into a .NET assembly that is loaded reflectively (fileless). Later layers use RC4 with a key derived through XOR and SHA-256 hashing, and an every-third-byte extraction routine to rebuild executable headers. Before the payload runs, the loader patches EtwEventWrite and NtManageHotPatch to blind Windows event tracing. A secondary payload, zeus.dat, is fetched (the report ties the delivery to dubaitechnicalservice.ae) and contains the Sirius backdoor. Later loaders create a legitimate process (msbuild.exe or svchost.exe) in a suspended state, hollow it, and use Early Bird APC injection so the backdoor executes inside the trusted process.

The backdoor config is identifiable via a Caffee_Config resource or a SIRIUS_STUB_CONFIG in-memory marker; behavior flags enable mutex checks, hidden file attributes and geographic restrictions. Persistence is achieved through registry Run entries, scheduled tasks, startup shortcuts and default-profile modifications. The C2 endpoint reported is 185.114.206.45:4449. Secondary-source summaries of the Trellix report (TechNadu, via search snippet; the page itself could not be fetched) attribute HVNC, SOCKS5 pivoting, Chromium credential harvesting and cryptocurrency wallet substitution to this Sirius variant. The GBHackers article states its own analysis does not establish specific password-extraction capabilities despite its headline, so credential theft should be treated as reported by secondary summaries, not independently confirmed here.

Analyst notes: no threat actor is named in the sources. The GBHackers article labels Early Bird injection as T1134.005, T1562.008 for ETW patching and T1027.010 for fileless execution; those IDs do not match the behaviors (T1134.005 is SID-History Injection, T1562.008 is cloud log impairment), so this record maps them to T1055.004, T1562.006 and T1620. The unrelated-by-evidence 'SiriusQT' RAT reported by Group-IB shares a name only; no source links it to this campaign. The Trellix primary page returned HTTP 403 to the harness, BeaconBeagle has no record for the C2 IP (HTTP 404) and no config match for the domain (empty result set); IOCs here come from the GBHackers reproduction of the Trellix indicators.

## MITRE ATT&CK

- T1566.001 Spearphishing Attachment
- T1204.002 Malicious File
- T1059.001 PowerShell
- T1140 Deobfuscate/Decode Files or Information
- T1027.013 Encrypted/Encoded File
- T1620 Reflective Code Loading
- T1685 Disable or Modify Tools
- T1055.012 Process Hollowing
- T1055.004 Asynchronous Procedure Call
- T1564.001 Hidden Files and Directories
- T1480 Execution Guardrails
- T1547.001 Registry Run Keys / Startup Folder
- T1053.005 Scheduled Task
- T1547.009 Shortcut Modification
- T1219 Remote Access Tools
- T1090 Proxy
- T1555.003 Credentials from Web Browsers
- T1574.002 Hijack Execution Flow
- T1562.001 Impair Defenses
- T1027 Obfuscated Files or Information
- T1115 Clipboard Data
- T1125 Video Capture
- T1123 Audio Capture
- T1105 Ingress Tool Transfer
- T1490 Inhibit System Recovery

## Sources

- [Trellix Research: Sirius backdoor fileless campaign using FedEx invoices](https://www.trellix.com/blogs/research/sirius-backdoor-fileless-campaign-fedex-invoices/)
- [New Sirius Backdoor Hides Inside Windows Processes to Steal Passwords and Evade Detection (GBHackers)](https://gbhackers.com/sirius-backdoor-variant/)
- [Sirius Backdoor Campaign Hides Fileless Malware in Spear-Phishing Emails Containing Fake FedEx Tax Invoices (TechNadu)](https://www.technadu.com/sirius-backdoor-campaign-hides-fileless-malware-in-spear-phishing-emails-containing-fake-fedex-tax-invoices/644634/)
- [Early Bird code injection technique background (The Hacker News)](https://thehackernews.com/2018/04/early-bird-code-injection.html)
- [Group-IB: SiriusQT RAT/HVNC stealer (name-similar malware, not linked to this campaign by any source)](https://www.group-ib.com/blog/siriusqt-rat-hvnc-stealer/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4540