Ankura CTIX FLASH Update – October 30, 2026

Malware Activity

Sirius Backdoor Campaign Uses Fake FedEx Invoices and Fileless Malware to Evade Detection and Survive Windows Resets

Trellix researchers uncovered a sophisticated, multistage malware campaign targeting South Korean organizations through Korean-language spear-phishing emails impersonating FedEx billing notifications. The emails contain ZIP attachments with malicious PDFs that, when opened and approved by the victim, execute encoded PowerShell commands to deploy the Sirius Backdoor through an encrypted, largely fileless infection chain. The malware employs advanced evasion techniques, including AES and RC4 encryption, payload obfuscation, disabling Windows Event Tracing (ETW), and Early Bird APC process hollowing to execute within legitimate Windows processes. Once deployed, the backdoor communicates with command-and-control infrastructure over TCP port 4449 and supports credential theft, keylogging, webcam and microphone surveillance, and cryptocurrency clipboard