Operation QUICSILVER Targets Myanmar Government and IT with QUICAgent Backdoor

Severity

Medium

Cybersecurity researchers have identified a cyber espionage campaign targeting organizations in Myanmar using fake graduation ceremony invitations to deliver a Go-based backdoor known as QUICAgent.

The campaign, tracked as Operation QUICSILVER, has targeted government and information technology organizations, according to Seqrite Labs. The activity is assessed with moderate confidence to be linked to a China-nexus threat actor.

How?

The campaign was first observed in April 2026 with a file named HolidayNotice.pdf.exe, which was distributed alongside a fake Belgian-Myanmar public holiday calendar. Two additional samples identified in June and July 2026 used Virtual Hard Disk (VHD) files to deliver the next stage of the infection.

The VHD files contain a Windows Shortcut (LNK) designed to look like a PDF document. When opened, the shortcut displays a fake graduation ceremony invitation written in Burmese. The document is presented as an official announcement from Myanmar’s Information Technology and Cyber Security Department (ITCSD), which operates under the Ministry of Transport and Communications.

While the fake invitation is shown to the victim, the LNK file launches ftp.exe, a legitimate Microsoft-signed Windows utility. The attackers abuse its -s option to execute commands contained in a local script.

The script searches for two files named header.doc and body.doc inside a hidden _rels directory. It then uses the Windows copy /b command to combine the two files and reconstruct the next-stage payload.

The reconstructed payload is a Go-based backdoor named QUICAgent. Before connecting to its command-and-control (C2) server, the malware performs activities designed to delay or evade automated sandbox analysis. These include introducing a random delay of 100 to 600 milliseconds and performing 1,000 rounds of SHA-256 hashing operations.

QUICAgent obtains the C2 server address by sending HTTP GET requests to two Cloudflare Workers domains. After retrieving the address, the malware builds the final connection using port 443 and communicates with the C2 server through QUIC over UDP port 443.

The malware’s initial beacon contains basic information about the compromised system. It sends a beacon every five seconds and assigns each infected device a unique X-Agent-ID. QUICAgent supports five commands that allow the attackers to execute commands, transfer files, browse directories, and change the beacon interval.

To maintain access, the malware creates an LNK file in the current user’s Windows Startup folder. This causes the malicious file to execute automatically when the user logs in again.

Overall, the campaign uses a multi-stage infection process that starts with a malicious LNK file, abuses the legitimate ftp.exe utility, reconstructs the payload from disguised document files, and ultimately deploys the custom Go-based QUICAgent backdoor.Separately, related China-linked activity targeting Myanmar has involved an updated variant of the COOLCLIENT backdoor. Kaspersky reported that the malware can deploy a signed kernel-mode driver, Msagent.sys, to improve its ability to remain hidden on compromised systems. The activity has also been observed in Mongolia, Pakistan, and Russia.

The updated COOLCLIENT variant retains capabilities including keylogging, clipboard collection, credential theft, file management, system reconnaissance, and plugin-based extensions. The kernel-mode driver can hide the malware process and protect associated files and registry entries from inspection or modification.

Source

https://thehackernews.com/2026/08/operation-quicsilver-targets-myanmar.html