Executive Summary
Trellix has identified a sophisticated phishing campaign delivering the Sirius Backdoor (a commercial malware family also known as SiriusQT). The attack begins with Korean-language emails masquerading as FedEx billing notifications containing a malicious ZIP-compressed PDF. This campaign is notable for its use of Windows provisioning packages to achieve persistence that survives a full OS reset, a technique that undermines traditional 'wipe and reinstall' recovery strategies.
The infection chain is highly evasive, employing fileless execution through Base64-encoded PowerShell launched directly from PDF process actions. Once active, the malware blinds endpoint sensors and utilizes process hollowing to hide within legitimate Windows processes. While initial targeting was observed in South Korea, the malware's geofencing configuration allows execution in 88 countries, indicating a significant potential for broader international impact.
This development represents a critical shift in adversary tradecraft, as standard incident response remediation—such as factory resets—may no longer be sufficient to clear an infected host. Security teams must adapt their recovery playbooks to account for persistent artifacts within the Windows provisioning framework.