A phishing campaign impersonating FedEx billing notices is being used to deliver a previously undocumented variant of a stealthy backdoor dubbed Sirius, according to research published by Trellix on October 26. The malware runs almost entirely in memory, leaving few traces on disk, and actively tampers with Windows’ own security logging to stay hidden from endpoint protection tools.

An Urgent-Sounding Invoice as Bait

The campaign targets people who handle billing and payments, using emails written in Korean with the subject line “[FedEx] A tax invoice has been issued.” The message claims a modest tax invoice, equivalent to roughly 218,000 Korean won, is due soon, a deliberately small and urgent-sounding amount designed to push accounting staff into opening the attachment without pausing to verify it. Trellix’s Threat Response Team discovered the campaign while investigating an alert triggered by a PDF file behaving unexpectedly on a customer’s system, which unraveled into a multistage infection chain.

A Blank PDF That Isn’t Actually Blank

The email arrives with a ZIP archive attached, a common tactic for slipping past basic email gateway filtering, containing a PDF that appears completely blank when opened. That emptiness is intentional: the file’s only real purpose is to trigger execution. Hidden commands embedded in the PDF automatically launch a PowerShell command as soon as the document opens, though the victim must still click through a security warning from their PDF reader, meaning the attack still depends on one more moment of user trust.

Layers Within Layers, Never Touching Disk

From there, the infection chain avoids ever writing a traditional executable to disk. The initial PowerShell command decrypts an AES-encrypted, compressed block directly in memory and loads it as a .NET assembly. That loader in turn derives a decryption key and reconstructs the next stage by selectively keeping only certain bytes from the data and discarding padding in between, a technique that means the final payload is never stored anywhere in a readable form. Each layer exists purely to unpack the one beneath it.

The second-stage component goes after the system’s own defenses directly: it patches Event Tracing for Windows inside a core system library, cutting off a data feed that many endpoint detection and response products rely on. It then retrieves the final payload from a remote server and injects it into trusted system processes using a technique known as Early Bird APC injection, which hides malicious code inside the startup sequence of a legitimate process before that process’s own security monitoring has fully initialized.

Built to Outlast a Reboot, or Even a Factory Reset

Sirius is engineered for long-term persistence. If it gains administrator privileges, it drops files into the Windows recovery customization path and creates a script that runs with system-level privileges during Windows setup, meaning it can potentially survive even a system reset. Without administrator rights, it falls back to writing a script into the Windows Startup folder and prompting the user for elevated permissions, and it can also masquerade as a legitimate system library to achieve persistence through DLL sideloading.

Once fully installed, the backdoor gives its operator a wide range of capabilities: opening hidden virtual desktops, routing traffic through an embedded proxy, capturing webcam and microphone feeds, harvesting saved credentials from Chromium-based browsers, and silently swapping cryptocurrency wallet addresses copied to the clipboard. It also adds exclusions to Microsoft Defender and deletes Volume Shadow Copies, a common tactic for hampering forensic recovery after an incident.

Defensive Recommendations

• Enable the Microsoft Defender Attack Surface Reduction rule that blocks Adobe Reader and similar PDF applications from spawning child processes.
• Enforce PowerShell Constrained Language Mode across the environment to limit what scripts can execute.
• Turn on PowerShell Script Block Logging and monitor for Event ID 4104 to catch obfuscated command execution.
• Flag unusual process chains, particularly a PDF reader launching PowerShell, as a high-priority detection rule.
• Review existing Microsoft Defender exclusions and scheduled tasks for signs of tampering, a step that has proven useful in related fileless malware investigations.

The campaign is a reminder that trusted shipping and billing brands remain one of the most effective lures for getting past both human skepticism and automated email filtering, and that fileless techniques are increasingly being packaged into off-the-shelf toolkits used across unrelated campaigns.