Sirius backdoor variant uses Windows processes to evade detection

Researchers have identified a previously undocumented variant of the Sirius backdoor that employs a multi-stage campaign to hide malicious code within legitimate Windows processes. The malware utilizes fileless techniques, loading .NET assemblies directly into memory through reflection to minimize detectable artifacts for conventional file scanning.

The infection chain typically begins with phishing emails written in Korean that impersonate FedEx billing notifications. These emails contain a weaponized PDF that, upon user approval of a security prompt, invokes PowerShell to decrypt and decompress an embedded payload using AES and GZip.

To maintain stealth, the malware uses multiple layers of obfuscation, including RC4 decryption and XOR manipulation. Additionally, the second loader attempts to interfere with security telemetry by patching EtwEventWrite and NtManageHotPatch, aiming to reduce visibility into its activities.