Operation QUICSILVER Delivers QUICAgent to Myanmar Targets

Myanmar government and IT organisations targeted

Seqrite Labs has identified Operation QUICSILVER, a cyber-espionage campaign targeting Myanmar’s government and information technology sectors with a Go-based backdoor named QUICAgent. The activity was first observed in April 2026 and is assessed with moderate confidence to be linked to a China-nexus threat actor.

The operation has used social-engineering lures designed to look relevant to local recipients. An early sample delivered a file called HolidayNotice.pdf.exe alongside a fabricated Belgian–Myanmar public holiday calendar. Artifacts detected in June and July 2026 instead used Virtual Hard Disk files to begin the infection chain.

A decoy invitation hides the execution chain

Inside the VHD is a Windows Shortcut file that masquerades as a PDF document. When opened, it shows a Burmese-language graduation ceremony invitation purportedly issued by the Information Technology and Cyber Security Department, which operates under Myanmar’s Ministry of Transport and Communications.

While that decoy occupies the victim, the LNK stealthily starts ftp.exe, a Microsoft-signed Windows binary. The attackers abuse its -s option to execute commands held in a local script. That script searches a hidden _rels directory for two files, header.doc and body.doc, then uses the native Windows copy /b command to combine them and reconstruct the next-stage payload.

QUICAgent evades sandboxes and calls home over QUIC

QUICAgent incorporates sandbox-evasion measures before establishing command-and-control communications. It waits for a random 100–600 milliseconds and carries out 1,000 SHA-256 hashing iterations, an approach intended to consume the execution time available to automated sandboxes.

The implant retrieves its backend command-and-control address with HTTP GET requests to two Cloudflare Workers domains. After obtaining the address, it appends port 443 and communicates with the server using QUIC over UDP port 443. Its initial beacon includes basic host information, repeats every five seconds, and assigns each infected system a unique X-Agent-ID.

The backdoor supports five commands for command execution, file transfers, directory browsing and beacon-interval changes. It persists by placing an LNK file in the current user’s Windows Startup folder, allowing execution at the next logon.

What defenders should review

The campaign combines VHD delivery, a malicious LNK, legitimate-binary abuse and payload reconstruction from files that resemble documents. Security teams should treat VHD and LNK attachments as high-risk, review executions of ftp.exe with script arguments, and investigate unexpected outbound QUIC traffic on UDP 443, particularly systems producing frequent beacon-like connections. Monitoring Startup-folder changes can also help identify persistence consistent with this infection chain.