Back Broadcom

Sirius Backdoor distributed under the FedEx disguise

Broadcom • October 27, 2026

Trellix cybersecurity researchers uncovered an advanced, multi-tiered attack distributing a newly identified C++ malware strain dubbed Sirius Backdoor. The intrusion starts with a financially-themed spear-phishing message impersonating FedEx, which delivers a zipped PDF file. When opened, the document leverages built-in action features and social engineering to persuade the victim into bypassing security warnings, subsequently running a concealed, Base64-encoded PowerShell script. This script loads an in-memory .NET component that injects the final Sirius payload into trusted Windows processes. Beyond standard remote access functions - such as file alteration, registry editing, process injection, and command-shell execution - Sirius incorporates specialized modules for stealthy control, espionage, and financial fraud. Furthermore, the malware conducts comprehensive spying by recording webcams, microphones, system audio, and targeted keystrokes. Finally, it harvests credentials from Chromium browsers and monitors the clipboard to swap copied cryptocurrency wallet addresses with attacker-owned accounts.

Symantec protects you from this threat, identified by the following:

SONAR.MalTraffic!gen1

Associated malicious indicators are blocked and detected by existing policies within Carbon Black products. The recommended policy at a minimum is to block all types of malware from executing (Known, Suspect, and PUP) as well as delay execution for cloud scan to get maximum benefit from Carbon Black Cloud reputation service.

Coverage is in place for Symantec's email security products and Email Threat Isolation (ETI) technology provides an extra layer of protection for our customers.

Machine Learning-based

Audit: Bad Reputation Application Activity

System Infected: Trojan.Backdoor Activity 568

System Infected: Trojan.Backdoor Activity 721

URL Reputation: Webpulse Bad Reputation Domain Request

Observed domains/IPs are covered under security categories in all WebPulse enabled products

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Sirius Backdoor and Armorsteal Malware Campaigns Target Cryptocurrency Users Broadcom's Trellix and Zscaler researchers reported two distinct malware campaigns targeting cryptocurrency users. The Sirius Backdoor, a C++ malware, is distributed via spear-phishing emails disguised as FedEx messages, leading victims to execute a malicious PowerShell script. This malware enables extensive remote access and espionage capabilities, including credential theft and clipboard manipulation. The Armorsteal malware, spread through SEO poisoning, tricks users into running a rogue PowerShell script that installs malicious Python modules. Armorsteal also captures sensitive data, including passwords and cryptocurrency wallet information. Both malware strains utilize sophisticated techniques to evade detection and exploit user trust. Symantec products are equipped to block these threats, and users are advised to implement strict security measures. 2 sources 63

Extracted Entities

Sirius Backdoor distributed under the FedEx disguise

The full story

Extracted Entities

Attack Types (2)

Malware (1)

MITRE ATT&CK (4)

Platforms (1)

Tools (1)