Operation QUICSILVER: China-Linked QUICAgent Backdoor Targets Myanmar

Cybersecurity researchers at Seqrite Labs have identified a China-nexus cyber espionage campaign, codenamed Operation QUICSILVER, targeting Myanmar's government and information technology sectors with a Go-based backdoor called QUICAgent. First observed in April 2026, the operation initially delivered a malicious file disguised as "HolidayNotice.pdf.exe" alongside a fabricated Belgian–Myanmar public holiday calendar. Two subsequent artifacts detected in June and July 2026 shifted to a multi-stage infection chain using Virtual Hard Disk (VHD) files containing a Windows Shortcut (LNK) that mimics a PDF document—a fabricated graduation ceremony invitation allegedly from Myanmar's Information Technology and Cyber Security Department (ITCSD), written in Burmese.

The LNK file launches "ftp.exe," a legitimate Microsoft-signed binary, abusing its "-s" option to execute commands from a local script that reconstructs the next-stage payload. As researchers Priya Patel and Kartik Jivani explained, the script locates two hidden files—header.doc and body.doc—inside a _rels directory and reassembles them using the native Windows "copy /b" command. The resulting payload, QUICAgent, is a Golang-based implant that performs sandbox evasion through a 100–600 millisecond random delay and 1,000 iterations of SHA-256 hashing to exhaust automated analysis time limits. Operators retrieving it dynamically via Cloudflare Workers domains, with the resolved C2 address ("104.64.211[.]22") served over QUIC on UDP port 443—a protocol choice that can complicate traditional network forensics and SSL/TLS inspection.

QUICAgent beacons to its server every five seconds, transmitting host metadata and a unique X-Agent-ID, and supports five commands for shell execution, file transfer, directory browsing, and beacon interval modification. Persistence is maintained by placing an LNK file in the current user's Windows Startup folder, ensuring execution at next logon. Given the campaign's reliance on QUIC for covert communications, defenders investigating similar activity should review outbound UDP 443 flows and validate endpoint egress using a DNS leak test and port scanner to identify unauthorized listeners or connections. The campaign's use of signed binary abuse, Living-off-the-Land techniques, and protocol tunneling aligns with broader threat intelligence trends observed across other China-nexus APT operations.