Ethical Hacking News
Operation QUICSILVER, a highly sophisticated cyber espionage campaign, has been identified by cybersecurity researchers, Seqrite Labs, as targeting the government and information technology sectors of Myanmar. The campaign uses a multi-stage infection chain to deliver a Go-based backdoor called QUICAgent, and is assessed to be the work of a China-nexus threat actor with moderate confidence.
Operation QUICSILVER is a sophisticated cyber espionage campaign targeting government and information technology sectors in Myanmar. The campaign uses a multi-stage infection chain to deliver a Go-based backdoor called QUICAgent. The backdoor is launched via a decoy PDF document invitation to a graduation ceremony, abusing a legitimate Microsoft-signed Windows binary. The malware uses sandbox evasion techniques and communicates with a C2 server using QUIC over UDP port 443. Persistence is achieved by setting up an LNK file in the Windows Startup folder. The campaign is attributed to a China-nexus threat actor with moderate confidence. The attackers' use of a multi-stage infection chain and evasion tactics are notable aspects of their tactics. The campaign highlights the ongoing threat posed by state-sponsored actors in the cyber espionage landscape.
Operation QUICSILVER, a highly sophisticated cyber espionage campaign, has been identified by cybersecurity researchers, Seqrite Labs, as targeting the government and information technology sectors of Myanmar. The campaign, which has been observed since April 2026, utilizes a multi-stage infection chain to deliver a Go-based backdoor called QUICAgent.
The campaign's use of graduation ceremony invitation lures to deliver the backdoor is a notable aspect of its tactics, with the attackers creating a decoy PDF document that appears to be an official graduation ceremony invitation from the Information Technology and Cyber Security Department (ITCSD). This serves as a distraction while the attacker launches a legitimate Microsoft-signed Windows binary, ftp.exe, which abuses its "-s" option to run commands stored in a local script file.
The script file searches for two document files, header.doc and body.doc, stored inside the hidden _rels directory, and combines them using the native Windows copy /b command to reconstruct the next-stage payload. This payload is a Golang-based implant dubbed QUICAgent, which performs sandbox evasion techniques before connecting to a command-and-control (C2) server.
The C2 server address is retrieved dynamically by sending an HTTP GET request to two Cloudflare Workers domains. Once the C2 address is obtained, it suffixes port 443 to the domain and constructs the final destination. The malware uses QUIC over UDP port 443 to communicate with the C2 server.
The initial beacon to the server also includes basic information about the compromised host, with each infected machine assigned a unique X-Agent-ID to identify the victim. QUICAgent is fairly basic in that it supports five commands to execute commands, transfer files, browse directories, and modify the beacon interval.
Persistence is achieved by setting up an LNK file in the current user's Windows Startup folder so that it's automatically executed the next time the user logs in to the system. The campaign's use of a multi-stage infection chain that begins with a malicious LNK file, abuses ftp.exe as a LOLBAS to execute the next stage, reconstructs the payload from two fake document files, and finally deploys a custom Go-based backdoor is a testament to the attackers' sophistication.
This campaign is assessed to be the work of a China-nexus threat actor with moderate confidence. The attackers' use of a legitimate Microsoft-signed Windows binary and their ability to evade sandbox detection are notable aspects of their tactics. The campaign's targeting of government and IT sectors in Myanmar suggests that the attackers' ultimate goal may be to compromise sensitive information or disrupt the country's IT infrastructure.
The disclosure of this campaign comes as the China-linked Mustang Panda actor has been observed using an updated version of a known backdoor called COOLCLIENT, which can deploy a signed kernel-mode driver. The backdoor is assessed to be deployed via PlugX using DLL sideloading, a technique extensively abused by the hacking group.
COOLCLIENT supports a wide array of capabilities, including keylogging, clipboard theft, credential harvesting, file management, system reconnaissance, and plugin-based extensions. It was first detected in the wild in 2022 and has been observed in intrusions across Myanmar, Mongolia, Pakistan, and Russia.
The attackers' use of a multi-stage infection chain and their ability to evade sandbox detection are notable aspects of their tactics. The campaign's targeting of government and IT sectors in Myanmar suggests that the attackers' ultimate goal may be to compromise sensitive information or disrupt the country's IT infrastructure.
The disclosure of this campaign highlights the ongoing threat posed by state-sponsored actors in the cyber espionage landscape. As the use of sophisticated malware and advanced tactics continues to evolve, it is essential for organizations and individuals to remain vigilant and take proactive measures to protect themselves against these types of threats.
Related Information:
https://www.ethicalhackingnews.com/articles/Operation-QUICSILVER-A-Sophisticated-Cyber-Espionage-Campaign-Targeting-Myanmar-Government-and-IT-ehn.shtml
https://thehackernews.com/2026/08/operation-quicsilver-targets-myanmar.html
Published: Mon Aug 24 07:48:02 2026 by llama3.2 3B Q4_K_M
