Cybercriminals are deploying a new strategy involving counterfeit FedEx tax invoices to infiltrate Windows systems with a sophisticated malware known as the Sirius Backdoor. This malicious software cleverly conceals itself within a seemingly innocuous PDF, executing its core operations directly in memory to avoid leaving detectable traces on the hard drive.
How the Phishing Scheme Works
The targeted emails are crafted to deceive individuals responsible for financial tasks, predominantly written in Korean with the subject line, ‘[FedEx] A tax invoice has been issued.’ These messages falsely notify recipients of an impending tax invoice amounting to 217,740 KRW, creating a false sense of urgency that prompts the recipients to open the attached file hastily.
Such phishing campaigns often mimic reputable brands to lull victims into a false sense of security, a tactic evident in previous fake app campaigns. Researchers from Trellix uncovered this particular malware during an in-depth investigation triggered by an anomaly on a client’s system.
Technical Details of the Malware
The phishing email includes a ZIP file labeled Fedex_tax_receipt.zip, a common tactic to bypass basic email security filters. Once extracted, it presents a PDF named Fedex_tax_receipt.pdf which appears blank but is designed to execute hidden commands. These commands initiate a PowerShell script once the PDF is opened, relying on user approval to bypass security prompts.
The PowerShell script doesn’t download an executable file; instead, it decrypts a compressed block of data in memory, facilitating a series of stages that reconstruct the malware without leaving visible traces on the hard drive. Each stage functions like a nesting doll, unpacking only the necessary components to advance to the next phase.
Defensive Measures and Recommendations
To hinder detection, the malware manipulates Windows processes and security tools. It obstructs Event Tracing for Windows, a key data source for many EDR tools, and embeds itself into trusted processes using a technique known as Early Bird APC injection.
To counteract such threats, Trellix advises enabling specific Microsoft Defender rules, including blocking Adobe Reader from generating child processes and enforcing PowerShell Constrained Language Mode. Security teams should also monitor for unusual process chains, especially those involving PDF readers triggering PowerShell commands.
In conclusion, the Sirius Backdoor exemplifies the growing sophistication of cyber threats leveraging trusted brand names to penetrate security defenses. Organizations must remain vigilant, updating their security protocols to detect and thwart such advanced threats. The implementation of comprehensive threat intelligence and proactive monitoring will be crucial in safeguarding against future attacks.
