Trellix has documented a phishing campaign that uses fake FedEx tax invoices to deliver a fileless Sirius Backdoor, malware that installs a custom Windows provisioning package so it can survive a full operating system reset. The researchers first saw it at a South Korean customer, where an unexpected PDF process triggered an alert in a priority incident.
The Korean-Language FedEx Billing Lure and Its Malicious PDF
The email is written in Korean and poses as FedEx Billing Online. It cites invoice number 724156148 and a payment of 217,740 won. Attached is a 205 KB ZIP file named Fedex_tax_receipt.zip containing a PDF that looks blank when opened.
The blank appearance hides the working part of the file. The PDF abuses the /OpenAction and /Launch features to run a hidden Base64-encoded PowerShell chain that executes in memory, so little malicious code is written to disk.
In-Memory PowerShell That Blinds Endpoint Sensors
According to Trellix, the PowerShell chain blinds endpoint sensors and then hollows legitimate Windows processes, hiding the backdoor inside programs that the operating system already trusts. The combination of fileless execution and process hollowing is aimed squarely at endpoint detection tools.
A Windows Provisioning Package for Persistence After Reset
The backdoor drops a custom Windows provisioning package. Provisioning packages are normally applied when a system is set up or reset, and this one lets the malware persist through a full operating system reset, an action that most administrators treat as a reliable way to clean an infected machine.
Links to the Commercial SiriusQT Malware Family
Configuration markers in the sample, named Caffee_Config and SIRIUS_STUB_CONFIG, tie it to the commercial SiriusQT family documented by Group-IB. Trellix assesses that the operator is likely an affiliate using a builder and a custom crypter. The company does not attribute the activity to a named actor.
The malware includes a geofence list that allows execution in about 88 countries, including the United States, Canada, Australia and European states. That reach is notable given that the observed lure was written for Korean readers: the geographic limits are set far wider than the first victim.
Why a Reset-Surviving Backdoor Changes Incident Response
The analytical significance of the Sirius findings lies in the persistence step. A standard response to a stubborn infection is to wipe and reinstall or reset the machine. If a provisioning package carries the backdoor through that process, the cleaning step itself fails, and organizations could find the same host reinfected after a reset they believed had worked.
The delivery chain also shows how attackers are adapting to endpoint tools. A PDF that opens blank and launches PowerShell in memory leaves few files for a scanner to inspect, and a hollowed process makes the running malware look like a normal Windows component. Trellix’s own discovery came from a behavioral signal, a PDF process doing something unexpected, instead of a signature match.
Trellix has published detections for the campaign. Its guidance centers on blocking PowerShell launched from PDF files and treating invoice ZIP attachments with suspicion. Neither the number of victims nor the full list of targeted sectors has been disclosed, so the campaign’s scale remains unclear beyond the South Korean case that exposed it.
The Korean-language targeting and the 88-country geofence point in different directions. The lure suggests the operator tailored this wave to a South Korean audience, yet the list of permitted countries means the same malware could run against organizations far outside that market. Trellix found the sample during a priority customer incident, which means the first confirmed victim was already a high-value customer of a security vendor, and the report does not indicate whether other customers received the same email.
