Malware Activity
Sirius Backdoor Campaign Uses Fake FedEx Invoices and Fileless Malware to Evade Detection and Survive Windows Resets
Trellix researchers uncovered a sophisticated, multistage malware campaign targeting South Korean organizations through Korean-language spear-phishing emails impersonating FedEx billing notifications. The emails contain ZIP attachments with malicious PDFs that, when opened and approved by the victim, execute encoded PowerShell commands to deploy the Sirius Backdoor through an encrypted, largely fileless infection chain. The malware employs advanced evasion techniques, including AES and RC4 encryption, payload obfuscation, disabling Windows Event Tracing (ETW), and Early Bird APC process hollowing to execute within legitimate Windows processes. Once deployed, the backdoor communicates with command-and-control infrastructure over TCP port 4449 and supports credential theft, keylogging, webcam and microphone surveillance, and cryptocurrency clipboard hijacking. Notably, the malware establishes multiple persistence mechanisms, including registry modifications, scheduled tasks, and malicious Windows provisioning packages capable of reinstalling the backdoor following a full operating system reset. Although researchers identified technical links to the commercial SiriusQT malware family, attribution to a specific threat actor remains unconfirmed. The campaign highlights the growing sophistication of fileless malware and the importance of monitoring suspicious PDF-triggered PowerShell activity, unauthorized provisioning packages, and anomalous network communications. CTIX analysts will continue reporting on active malware campaigns and up-and-coming tactics, techniques, and procedures.
Threat Actor Activity
Law Enforcement Seizes Virtualine Bulletproof Hosting Hub for Global Cybercrime
US and European authorities have seized the primary domain and servers of Virtualine, a bulletproof hosting provider that operated under names like Secury, Massgod, Spamhouse, Lanedo, and Omegatech. Court documents say Virtualine knowingly hosted “Vendor 1,” a criminal forum selling hacked explicit images of adults and minors and offering hack-for-hire services, despite repeated abuse notices from law enforcement and NCMEC. Virtualine also accepted direct Bitcoin payments via unhosted wallets and laundered proceeds, with blockchain analysis tying its footprint to ransomware groups (including The Gentlemen, INC, DragonForce, Qilin), infostealers like StealC, Russian drug markets, sextortion schemes, and other illicit services. Dutch police seized dozens of physical servers in Limburg, gaining data on more than 3,000 criminal customers and taking hundreds of virtual servers offline.
- Bleeping Computer: Virtualine Bulletproof Service Seizure Article
- The Hacker News: Virtualine Bulletproof Service Seizure Article
- DOJ: Bulletproof Service Seizure Press Release
Vulnerabilities
CISA Confirms Active Exploitation of Critical Brotli Vulnerability
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed active exploitation of a critical vulnerability in Google’s Brotli compression library, tracked as CVE-2026-111497 and commonly known as Node2Shell, Broccoli2Shell, or HTTP2Shell. The flaw stems from an out-of-bounds write in the Brotli decoder that allows unauthenticated remote attackers to exploit specially crafted compressed data to corrupt memory, disclose sensitive information, cause denial-of-service (DoS) conditions, or potentially achieve remote code execution (RCE). Initially identified in Node.js, the vulnerability also affects HTTP servers, clients, and applications using vulnerable Brotli implementations, including certain Microsoft .NET environments where exploitation could enable privilege escalation. Microsoft has released emergency security updates, while CISA added the vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog on October 27, requiring federal agencies to remediate affected systems by no later than November 10, 2026. CTIX analysts urge organizations to prioritize patching, restart affected processes, and rebuild vulnerable container images. Where immediate remediation is not possible, administrators should temporarily block incoming Brotli-compressed requests or disable Brotli decoding to reduce exposure.
📧 Never Miss a Briefing
Stay informed and secure. Subscribe to Ankura’s Cyber Flash Update, a bi-weekly briefing curated by our top cybersecurity experts. Receive timely insights on emerging threats, vulnerabilities and malicious actors to keep your systems secure.
Join the Cyber Flash Update community today.
© Copyright 2026. The views expressed herein are those of the author(s) and not necessarily the views of Ankura Consulting Group, LLC., its management, its subsidiaries, its affiliates, or its other professionals. Ankura is not a law firm and cannot provide legal advice.
