Operation QUICSILVER Targets Myanmar Government and IT with QUICAgent Backdoor
Seqrite Labs documents Operation QUICSILVER, a China-nexus cyber espionage campaign using Burmese-language graduation ceremony lures to deliver a Go-based QUICAgent backdoor against Myanmar's government and IT sectors.
Intelligence analysis by Llama
Seqrite Labs has detailed Operation QUICSILVER, an espionage campaign that uses Burmese-language graduation ceremony invitations as decoys to deploy a Go-based backdoor called QUICAgent against Myanmar's government and IT sectors. The activity, attributed with moderate confidence to a China-nexus threat actor, was first observed in April 2026.
Some sneaky computer attackers sent fake graduation party invitations to people working for Myanmar's government. When someone opened the invite, a hidden program snuck onto their computer and started sending secret messages back to the attackers using a fast new internet language called QUIC, so the government could snoop on files. The attackers are thought to be from China.
Analysis
QUICAgent's Multi-Stage Infection Chain
The infection begins with a file disguised as a legitimate document. The earliest sample, observed in April 2026, was named "HolidayNotice.pdf.exe" and paired with a fabricated Belgian–Myanmar public holiday calendar, while later June and July 2026 artifacts arrive inside Virtual Hard Disk (VHD) containers. Inside the VHD sits a Windows shortcut that mimics a PDF, opening a decoy graduation ceremony invitation on screen while, in the background, it abuses the Microsoft-signed binary ftp.exe using its -s option to silently run a local script. That script searches the hidden _rels directory for two fragments, header.doc and body.doc, and stitches them back together using the native copy /b command to reconstruct the QUICAgent payload. According to Seqrite Labs researchers Priya Patel and Kartik Jivani, this staged approach is designed to defeat casual file inspection and many static scanners.
Once reconstituted, the Go-based implant runs sandbox-evasion routines, including a 100–600 millisecond random delay and one thousand iterations of SHA-256 hashing to exhaust automated analysis timeouts, before fetching its command-and-control address. It sends an HTTP GET request to two Cloudflare Workers domains, retrieves the C2 host (104.64.211[.]22), and appends port 443 to construct a final destination that speaks QUIC over UDP, a protocol choice that blends malware traffic with legitimate modern web communications. Beacons fire every five seconds carrying basic host metadata and a unique X-Agent-ID, and the implant supports only five commands for shell execution, file transfer, directory listing, and beacon interval adjustment. Persistence is handled by planting a shortcut in the current user's Windows Startup folder, ensuring the implant relaunches at the next logon.
ITCSD and the Burmese Decoy Strategy
The social engineering is tightly localised. The decoy PDF is written in Burmese and purports to originate from the Information Technology and Cyber Security Department (ITCSD), a real body operating under Myanmar's Ministry of Transport and Communications, and is framed as a graduation ceremony announcement. Researchers note that the operational security around the lure is deliberate: it gives the shortcut time to silently trigger the ftp.exe abuse while the victim reads a plausible, on-brand government document. The use of a Belgian–Myanmar holiday calendar in the April 2026 iteration suggests the operators tailored secondary bait to match working schedules inside Myanmar's ministries, where European diplomatic calendars are sometimes referenced.
This level of cultural tailoring, combined with the choice of QUIC as a transport and the dynamic C2 resolution through Cloudflare Workers, indicates a campaign that is technically current and operationally patient, characteristics that complicate detection for defenders who rely on signature-based controls or who do not inspect encrypted UDP traffic on port 443.
COOLCLIENT's Kernel-Mode Reinvention
The QUICSILVER disclosure lands alongside a separate finding from Kaspersky that the China-linked Mustang Panda actor has refreshed its COOLCLIENT backdoor, first seen in 2022, with a previously undocumented kernel-mode driver called Msagent.sys similar to the kernel enhancements used in TONESHELL. COOLCLIENT already supports a broad capability set, including keylogging, clipboard theft, credential harvesting, file management, and system reconnaissance, with plug-in extensions layered on top, and it is typically delivered via PlugX through DLL sideloading. The new driver hides the COOLCLIENT process, protects its files and registry entries from inspection, and prevents tampering, raising the bar for forensic analysis and endpoint protection tools. Kaspersky reports the updated variant and its driver in intrusions across Myanmar, Mongolia, Pakistan, and Russia, suggesting the same regional targeting pattern that defines QUICSILVER is being reinforced with stronger stealth capabilities from a second China-nexus toolkit.
Key points
- Seqrite Labs documents Operation QUICSILVER, a campaign first observed in April 2026 that targets Myanmar's government and IT sectors with a Go-based backdoor called QUICAgent.
- Infection chains abuse the Microsoft-signed `ftp.exe` binary via its `-s` option, reconstruct payloads from fragments named `header.doc` and `body.doc`, and present Burmese-language decoy invitations purporting to come from Myanmar's ITCSD.
- The QUICAgent implant uses QUIC over UDP port 443, retrieves its C2 address (104.64.211[.]22) dynamically through Cloudflare Workers, beacons every five seconds, and persists via a shortcut in the Windows Startup folder.
- Seqrite attributes the activity with moderate confidence to a China-nexus threat actor; the disclosure coincides with a separate Kaspersky finding that the China-linked Mustang Panda group is using a refreshed COOLCLIENT backdoor with a new kernel-mode driver, `Msagent.sys`, i…
If the QUICAgent implant and the refreshed COOLCLIENT tooling both reflect the same regional operation tempo, Myanmar's ministries and IT providers face an elevated risk of sustained data exfiltration across multiple intrusions. The QUIC transport, dynamic C2 resolution through Cloudflare Workers, and the new kernel-mode driver that hides processes and registry entries will likely degrade detection rates, giving the operators longer dwell times before defenders can respond.
