Multi-Stage Malware Campaign Targets Myanmar Diplomats: Operation QUICSILVER
A sophisticated cyber campaign, identified as a creation of a China-nexus threat actor, has been targeting government officials and diplomatic personnel in Myanmar. This multi-stage malware assault is notable for its ingenious tactics, utilizing a custom-built Go-based backdoor known as QUICAgent. The attackers are cleverly concealing this malicious software in Virtual Hard Disk (VHD) files, disguised as innocuous images to evade detection.
The Mechanics of Deception
At the heart of this operation is a highly targeted social engineering strategy. A defining example of the campaign is a malicious file labeled TrainingAnnouncement.jpg. While it appears to be a harmless image, it is actually a VHD container. Upon mounting the file, the victim is presented with what seems to be a PDF invitation for a graduation ceremony, supposedly issued by Myanmar’s Information Technology and Cyber Security Department (ITCSD), a division under the Ministry of Transport and Communications.
This false invitation is crafted to simulate an official notice, complete with a watermark from the ministry, to lend it an air of authenticity. Unfortunately, what the victim perceives as a legitimate PDF is a shortcut file named TrainingAnnouncement.pdf.lnk. The risk increases as Windows operating systems often hide known file extensions, which means users may be misled into believing they are opening a trustworthy document.
Once the shortcut is activated, a chain reaction of infection initiates. The system calls upon the Microsoft-signed ftp.exe utility, directing it to process a local script filed under the name _. This script serves a dual purpose; it opens the genuine decoy invitation, while simultaneously searching for two documents: header.doc and body.doc, located in a concealed _rels directory. The script then utilizes the copy /b command to merge these disguised files into one, ultimately creating Windowsupdate.exe in the %LOCALAPPDATA% path before executing the final malicious program.
The Campaign’s Components
The exploitation of trusted Windows utilities not only sidesteps conventional detection methods, but also complicates the identification of the broader threat landscape. According to the cybersecurity firm Seqrite, this campaign is part of a series targeting Myanmar, with at least three related efforts documented. The earliest of these, noted in April 2026, involved the usage of HolidayNotice.pdf.exe alongside a fabricated public holiday calendar that erroneously attributed significance to Belgian-Myanmar relations, indicating that the attackers may have an interest in Belgian organizations operating within Myanmar, including diplomatic entities and NGOs.
Seqrite has been tracking this activity under the moniker Operation QUICSILVER, asserting a moderate degree of confidence in its link to Chinese operations based on victim profiles, infrastructural similarities, and overlapping tradecraft with the earlier-documented Operation GriefLure.
QUICAgent: Remote Access and Data Compromise
In subsequent campaigns, particularly in June and July, the VHD samples TrainingAnnouncement.jpg and ACMECS_Pillar_1.vhd were deployed. While different decoys were used, all shared the same method for infection flow, payload family, and command-and-control infrastructure. QUICAgent, a 64-bit implant built on Go 1.20, is designed for functionalities that include remote access, data collection, and task execution by the operator.
Before engaging in its malicious activities, QUICAgent introduces random delays and carries out 1,000 SHA-256 operations, likely in an effort to overwhelmed automated sandbox systems. This sophisticated backdoor collects critical information, such as the compromised host’s DNS hostname and current username. It then communicates back to its handler at five-second intervals using RC4-encrypted JSON via HTTP/3 POST requests.
Interestingly, QUICAgent resolves its backend infrastructure dynamically through Cloudflare Workers endpoints. During analysis, Seqrite identified that a Workers service returned register[.]mediumser[.]com, which was later resolved to the IP address `104[.]64[.]211[.]22. Moreover, QUICAgent comes equipped with a self-signed “RAT CA” certificate, employing custom certificate-verification logic that allows operators more control over TLS trust compared to standard Go validation methods.
The command capabilities of QUICAgent include functionalities like shell, upload, download, list_dir, and set_heartbeat. These commands empower attackers to execute actions, transfer files, enumerate directories, and manage communication protocols effectively.
Persistence and Operational Security
To maintain its foothold within compromised systems, QUICAgent establishes persistence via the SystemIn.lnk file, which is placed within the current user’s Startup directory. This process is initiated through a temporary PowerShell script, which ensures that Windowsupdate.exe is relaunching each time the user logs in.
Researchers have also uncovered deleted documents from the VHD’s $Recycle.Bin directory. These documents encompassed sensitive materials linked to regional organizations and diplomacy, including references to BIMSTEC, ASEAN affairs, assessments from Malaysia on Myanmar, and purported internal documents from the Myanmar Ministry of Foreign Affairs.
Recommendations for Mitigation
In light of these developments, cybersecurity professionals advise vigilance regarding VHD attachments disguised as media files. There should be strict scrutiny of untrusted .LNK files and an enforcement of blocking or carefully scrutinizing any execution access related to them. Additionally, a keen awareness of ftp.exe being launched with local script parameters will be instrumental in identifying and neutralizing QUICSILVER’s footprints.
Monitoring unusual QUIC traffic over UDP/443, along with keeping an eye on Cloudflare Workers lookups and signs of %LOCALAPPDATA%\Windowsupdate.exe, can significantly bolster defenses against this evolving threat landscape. As the geopolitical implications of this malware campaign unfold, it becomes increasingly critical to understand the intersection of cybersecurity and international relations, particularly in the context of Myanmar’s diplomacy.