Operation QUICSILVER: Cyber Espionage Campaign Targets Myanmar's Government

Cybersecurity researchers have flagged a cyber espionage campaign targeting Myanmar, which utilizes graduation ceremony invitation lures to deliver a malicious backdoor known as QUICAgent. This operation, referred to as Operation QUICSILVER, primarily targets the government and information technology sectors, according to findings from Seqrite Labs. The campaign is believed to be executed by a threat actor with connections to China, assessed with moderate confidence.

The campaign was first detected in April 2026, when attackers delivered a file named "HolidayNotice.pdf.exe" alongside a fabricated Belgian-Myanmar public holiday calendar. Subsequent artifacts were identified in June and July 2026, utilizing a Virtual Hard Disk (VHD) file that initiates the infection chain.

Inside the VHD file, a Windows Shortcut (LNK) masquerades as a PDF document. When the victim opens this document, it displays a decoy PDF that appears to be an official graduation ceremony invitation from the Information Technology and Cyber Security Department (ITCSD) of Myanmar's Ministry of Transport and Communications. This distraction allows the shortcut file to stealthily execute "ftp.exe," a legitimate Microsoft-signed Windows binary, which then runs commands stored in a local script file.

As the decoy is shown on the victim's screen, the script searches for two document files, header.doc and body.doc, located in a hidden _rels directory. It combines these files using the Windows copy /b command to reconstruct the next-stage payload.

The payload is a Golang-based implant named QUICAgent, which employs sandbox evasion techniques before establishing a connection to a command-and-control (C2) server. Notably, it incorporates a random delay of 100-600 milliseconds and executes 1,000 iterations of SHA-256 hashing operations to exhaust automated sandbox execution time limits.

The backend C2 server address is dynamically retrieved by sending an HTTP GET request to two Cloudflare Workers domains. Once the C2 address is obtained, it appends port 443 to the domain to create the final destination. The malware communicates with the C2 server using QUIC over UDP port 443.

The initial beacon sent to the server includes basic information about the compromised host and is transmitted every five seconds. Each infected machine is assigned a unique X-Agent-ID for identification. QUICAgent supports five commands for executing commands, transferring files, browsing directories, and modifying the beacon interval.

Persistence is achieved by creating an LNK file in the current user's Windows Startup folder, ensuring it runs automatically upon the user's next login.

The campaign employs a multi-stage infection chain that begins with a malicious LNK file, utilizes ftp.exe as a LOLBAS to execute the next stage, reconstructs the payload from two fake document files, and ultimately deploys the custom Go-based backdoor known as QUICAgent. This disclosure coincides with observations of the China-linked Mustang Panda actor using an updated version of a known backdoor called COOLCLIENT, which can deploy a signed kernel-mode driver, enhancing its stealth capabilities.