Unveiling a New Variant of the Sirius Backdoor: A Stealthy Cybersecurity Threat
In a concerning development for cybersecurity experts, a previously undocumented variant of the Sirius backdoor has come to light during a priority investigation involving a customer. This discovery highlights a sophisticated multistage campaign that cleverly conceals malicious code within legitimate Windows processes, exemplifying a growing trend in cyber attacks that strive for greater stealth and efficacy.
The analysis associated with this variant reveals its ability to establish stealthy remote access and maintain persistence within the victim’s system. However, it remains uncertain whether this version possesses specific capabilities for password extraction. The implications are significant, as such capabilities could open doors to more serious breaches of sensitive information.
One notable aspect of this threat is the financial urgency incorporated into the phishing attempts, along with regional customization strategies that reflect established techniques. Cybercriminals often exploit established trust in familiar brands, and this campaign is no exception. It cleverly employs visual deception by using seemingly innocuous documents designed to urge victims to act quickly without suspecting foul play.
The method of attack primarily involves the use of a visually blank document. Utilizing PDF/OpenAction and /Launch objects, the adversaries can initiate PowerShell with commands designed to run in a hidden window, utilize non-interactive settings, and bypass execution policies. A crucial element of this attack is that the execution ultimately relies on the victim approving the security confirmation prompt from their PDF reader, meaning that merely opening the attachment does not automatically lead to a compromise.
The sophistication of this operation is further underscored by its utilization of Base64 encoded PowerShell commands, which are capable of decrypting embedded payloads using AES encryption in CBC mode. The process involves decompressing the payload via GZip and loading the resulting .NET assembly directly into memory through reflection. This technique notably minimizes the number of executable artifacts that conventional file scanning tools can detect, which is a hallmark trait of fileless malware.
The initial loader of this malware variant establishes an additional layer of obfuscation by deriving an RC4 key through XOR manipulation and SHA256 hashing. It decrypts internal resources and reconstructs the next assembly by extracting specific bytes while discarding unnecessary data. This meticulous method allows adversaries to restore the executable’s MZ header before reflective execution, heightening the invisibility of their operations.
According to Trellix Researchers, the campaign often begins with emails written in Korean, masquerading as FedEx billing notifications. Recipients are lured into clicking a fraudulent tax invoice demanding payment and leading them to download a zip file named “Fedex_tax_receipt.zip,” which contains a weaponized PDF designed to execute the payload upon opening.
Security researchers have flagged the second loading process as particularly concerning; it tries to interfere with Windows security telemetry by patching essential event writing functions. While this might enhance its stealth capabilities, the evidence provided does not confirm whether it renders all Windows logging or endpoint detection entirely ineffective.
After initial actions, the injector retrieves data from a specified domain, employing a download routine that supports various .NET networking interfaces. In this case, an RC4 encrypted URL obscures the underlying destination within the binary. In terms of execution, to carry out its malicious tasks, the loader creates a legitimate process that runs in a suspended state, embeds malicious content directly into its memory, and queues execution through asynchronous procedures. Potential hosts for this activity may include familiar processes such as msbuild.exe or svchost.exe, enabling the backdoor to operate within benign-looking contexts.
The researchers characterize this execution process as employing techniques such as process hollowing, combined with Early Bird APC injection. This distinction is critical, as defenders must delve into process ancestry, memory contents, and execution behaviors, rather than relying solely on superficial executable names.
The Sirius backdoor operates on the Microsoft Visual C++ platform, with its configuration potentially stored in a Caffee_Config resource or signified by a SIRIUS_STUB_CONFIG marker in memory. The configuration that has been analyzed identifies a command and control endpoint—185.114.206[.]45:4449—using Microsoft-themed installation paths.
Other behavioral flags enable malicious routines that check for mutexes, influence hidden file attributes, establish geographic restrictions, and manipulate registry Run entries among other tactics for persistence. Notably, while this campaign engages in memory-resident delivery, it can also leave artifacts written to disk, which means it’s not entirely fileless.
In addressing this urgent threat, security teams must prioritize correlating suspicious PowerShell executions instigated by PDF attachments with any unusual child processes and outbound connections. A multi-layered defense approach that combines attachment inspection, endpoint monitoring, and comprehensive network visibility offers a more robust shield than merely relying on file signatures or blocking individual infrastructure indicators.
By highlighting the importance of vigilance in the digital landscape, this revelation about the Sirius backdoor underscores the ongoing battle cybersecurity experts face against increasingly sophisticated cyber threats.