Operation QUICSILVER Targets Myanmar Government and IT with QUICAgent Backdoor

Summary

A cyber espionage campaign named Operation QUICSILVER has been targeting Myanmar's government and IT sectors, utilizing a Go-based backdoor called QUICAgent. The campaign, observed since April 2026, employs sophisticated multi-stage infection chains, including VHD files and abusing legitimate Windows binaries like ftp.exe, to deploy the malware. Researchers assess it to be the work of a China-nexus threat actor.

Full text

Operation QUICSILVER Targets Myanmar Government and IT with QUICAgent Backdoor Ravie LakshmananAug 24, 2026Cyber Espionage / Cyber Attack Cybersecurity researchers have flagged a cyber espionage campaign targeting Myanmar that uses graduation ceremony invitation lures to deliver a Go backdoor called QUICAgent. The campaign, codenamed Operation QUICSILVER, has been found to target government and information technology sectors, per Seqrite Labs. The activity is assessed to be the work of a China-nexus threat actor with moderate confidence. It was first observed in April 2026, when the attack was observed delivering a file named "HolidayNotice.pdf.exe" along with a lure that was a fabricated Belgian–Myanmar public holiday calendar. Two subsequent artifacts, each detected in June and July 2026, make use of a Virtual Hard Disk (VHD) file that activates the infection chain. Present within the VHD file is a Windows Shortcut (LNK) that mimics a PDF document. Opening the document displays a decoy PDF to the victim, an official graduation ceremony invitation that's written in Burmese and purports to be from the Information Technology and Cyber Security Department (ITCSD), which operates under Myanmar's Ministry of Transport and Communications. The "announcement" serves as a distraction while the shortcut file stealthily launches "ftp.exe," a legitimate Microsoft-signed Windows binary, and abuses its "-s" option to run commands stored in a local script file. "While the decoy is presented on the victim's screen, the script searches for two document files, header.doc and body.doc, stored inside the hidden _rels directory," security researchers Priya Patel and Kartik Jivani said. "It then combines these two files using the native Windows copy /b command to reconstruct the next-stage payload." The payload is a Golang-based implant dubbed QUICAgent that performs sandbox evasion techniques before connecting to a command-and-control (C2) server. Specifically, it incorporates a random delay of 100-600 milliseconds and executes 1,000 iterations of SHA-256 hashing operations to exhaust automated sandbox execution time limits. The backend C2 server address is retrieved dynamically by sending an HTTP GET request to two Cloudflare Workers domains. Once the C2 address is obtained ("104.64.211[.]22"), it suffixes port 443 to the domain and constructs the final destination. The malware uses QUIC over UDP port 443 to communicate with the C2 server. The initial beacon to the server also includes basic information about the compromised host. The beacon is transmitted every five seconds, with each infected machine assigned a unique X-Agent-ID to identify the victim. QUICAgent is fairly basic in that it supports five commands to execute commands, transfer files, browse directories, and modify the beacon interval. Persistence is achieved by setting up an LNK file in the current user's Windows Startup folder so that it's automatically executed the next time the user logs in to the system. "The campaign uses a multi-stage infection chain that begins with a malicious LNK file, abuses ftp.exe as a LOLBAS to execute the next stage, reconstructs the payload from two fake document files, and finally deploys a custom Go-based backdoor that we have named QUICAgent," the Indian cybersecurity company said. The disclosure comes as the China-linked Mustang Panda actor has been observed using an updated version of a known backdoor called COOLCLIENT that can deploy a signed kernel-mode driver ("Msagent.sys"), similar to the kernel-mode enhancements identified in TONESHELL. The backdoor is assessed to be deployed via PlugX using DLL sideloading, a technique extensively abused by the hacking group. COOLCLIENT supports such a wide array of capabilities as keylogging, clipboard theft, credential harvesting, file management, system reconnaissance, and plugin-based extensions. It was first detected in the wild in 2022. "The driver enhances the malware's stealth by hiding the COOLCLIENT process, protecting related files and registry entries, and preventing them from being inspected or modified," Kaspersky said, adding it detected the updated variant and its accompanying driver in intrusions across Myanmar, Mongolia, Pakistan, and Russia. "While the overall execution flow remains consistent with previously documented COOLCLIENT variants, this sample introduces a previously undocumented kernel-mode driver that significantly expands the malware's stealth capabilities." Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. SHARE     Tweet Share Share Share SHARE  Cyber Attack, cyber espionage, endpoint security, Malware, Social Engineering, Threat Intelligence, Windows Security ⚡ Top Stories This Week Microsoft Patches Severe Entra ID Flaw (CVSS 10.0) Allowing Remote Code Execution ThreatsDay: Gogs 10.0 RCE, n8n Workflow-to-RCE, $10M Reward, GLM-5.3 AI Exploit, and More New Cryptographic Context Injection Attack Could Let Web Pages Steal Grok Chat Data Zombie Card Attack Can Revive Expired Visa Cards for Contactless Payments CDN Tsunami Attack Abuses HTTP/3 Translation for Up to 350x DoS Amplification Manic Android Malware Exfiltrates Data From Offline Phones via Nearby Infected Devices Cloudflare Workers Spectre Attack Leaks JWT From Co-Located Worker at 12 Bits/Second OpenAI Pauses Frontier RL Training as It Tightens Defenses Against Unsafe AI Behavior Hackers Compromised 14,500+ Dahua Devices Using Credential Attacks, Auth Bypasses, and P2P Microsoft Copilot Personal Flaws Could Let One Click Exfiltrate Data From Connected Apps AI "Mind Viruses" Can Spread Between Agents Through Persistent Prompt Files SafePal Hardware Wallet Maker Says Flaw Exposed Data of Nearly 40,000 Customers Critical GitLab GraphQL Flaw Could Let Unauthenticated Attackers Delete Public Projects ⚡ Weekly Recap: VMware Exploits, Windows 0-Day, MCP Attacks, Browser Hijacks and More Unisoc VoLTE Video Call Exploit Chain Can Give Attackers Full Android Kernel Access Evooo1Bot Linux Botnet Exploits Known Flaws to Turn Edge Devices Into SOCKS5 Proxies SAP Commerce Cloud CVE-2026-58231 Targeted in Exploitation Attempts Days After Patch Hackers Spend Nearly $7 Million on Expired Domains to Redirect Traffic to Scams and Malware Apple Warns Users in 110 Countries They May Be Targets of Mercenary Spyware Trump Memo Paves Way for U.S. Firms to Hack and Disrupt Foreign Crime Groups GeoServer Zero-Day Targeted in Active Exploitation Attempts, Can Lead to RCE Attackers Exploit SharePoint Authentication Bypass After Public PoC Release Lazarus Exploits Windows Zero-Day to Gain SYSTEM Access and Deploy Backdoor Attackers Exploit VMware vCenter Vulnerability to Gain Persistent Remote Access ShieldBreak Zero-Day PoC Claims Microsoft Defender Patch Bypass With SYSTEM Access ⭐ Featured Resources See How Keeper Secrets Manager Removes Hard-Coded Credentials Download the CISO's Guide to Smarter AI Security Investment Phishing Is Costing Security Teams More Than Ever — Read the New Report Build AI Agents and Automations Without Losing Security Control

Indicators of Compromise

• malware — QUICAgent
• malware — COOLCLIENT
• malware — Msagent.sys

Entities