Cybersecurity researchers have uncovered a cyber espionage campaign targeting organizations in Myanmar with a sophisticated infection chain designed to deploy a Go-based backdoor known as QUICAgent.
Dubbed Operation QUICSILVER, the campaign primarily targets government and information technology organizations, according to researchers at Seqrite Labs. The activity has been attributed with moderate confidence to a China-nexus threat actor.
Campaign Uses Graduation Ceremony Invitations as Lures
The campaign was first observed in April 2026, when attackers distributed a malicious executable named HolidayNotice.pdf.exe. The file was accompanied by a fake Belgian–Myanmar public holiday calendar designed to appear legitimate to potential victims.
Two additional attack artifacts identified in June and July 2026 used a Virtual Hard Disk (VHD) file to initiate the infection process.
Inside the VHD was a Windows Shortcut (LNK) file disguised as a PDF document. When opened, the shortcut displayed a decoy PDF containing an official-looking graduation ceremony invitation written in Burmese.
The invitation purported to originate from Myanmar’s Information Technology and Cyber Security Department (ITCSD), which operates under the Ministry of Transport and Communications.
The legitimate-looking document serves as a distraction while malicious activity runs in the background.
Attack Abuses Legitimate Windows Binary
Behind the scenes, the malicious LNK launches ftp.exe, a legitimate Microsoft-signed Windows utility. The attackers abuse its -s option to execute commands contained in a local script.
According to Seqrite Labs researchers Priya Patel and Kartik Jivani, the script searches the hidden _rels directory for two files named header.doc and body.doc.
The two files are then combined using Windows’ native copy /b command, reconstructing the next-stage malware payload.
This technique allows the attackers to hide the actual payload among files that appear to be ordinary documents.
QUICAgent Uses Sandbox Evasion Techniques
The reconstructed payload is a Golang-based implant that researchers have named QUICAgent.
Before establishing communication with its command-and-control (C2) infrastructure, the malware performs several sandbox-evasion checks. It introduces a random delay of between 100 and 600 milliseconds and performs 1,000 iterations of SHA-256 hashing operations.
The resource-intensive activity is designed to consume automated analysis time and potentially prevent security sandboxes from reaching the malware’s main execution stage.
Once the checks are completed, QUICAgent attempts to establish communication with its C2 server.
Malware Uses QUIC Over UDP Port 443
The malware dynamically obtains its C2 address by sending HTTP GET requests to two Cloudflare Workers domains.
After receiving the C2 information, QUICAgent constructs the final destination and communicates with the server using QUIC over UDP port 443.
The initial beacon contains basic information about the compromised computer. The malware sends a beacon approximately every five seconds, while each infected system receives a unique X-Agent-ID that allows the attackers to track individual victims.
Despite its relatively simple design, QUICAgent supports several useful commands. These include:
Executing commands on the compromised system
Uploading and downloading files
Browsing directories
Changing the beacon interval
QUICAgent Gains Persistence Through Startup Folder
The malware also establishes persistence by placing an LNK file in the current user’s Windows Startup folder.
This causes the malicious shortcut to execute automatically whenever the affected user logs into Windows, allowing the attackers to maintain access even after the initial infection stage has completed.
Seqrite Labs described the campaign as a multi-stage operation that combines social engineering, legitimate Windows utilities and a custom backdoor.
The attack begins with a malicious LNK file, abuses ftp.exe as a Living-off-the-Land Binary (LOLBin), reconstructs the payload from two disguised document files and ultimately deploys the QUICAgent backdoor.
Mustang Panda Also Targets Myanmar With Stealthier Malware
The disclosure comes as another China-linked threat actor, Mustang Panda, has been observed deploying an updated version of the COOLCLIENT backdoor.
The updated malware can deploy a signed kernel-mode driver named Msagent.sys, introducing additional stealth capabilities similar to kernel-mode enhancements previously associated with TONESHELL.
Researchers assess that COOLCLIENT is delivered through PlugX using DLL sideloading, a technique that has been extensively used by Mustang Panda.
COOLCLIENT has a broad range of capabilities, including keylogging, clipboard theft, credential harvesting, file management and system reconnaissance. It also supports plugin-based extensions.
The backdoor was first observed in the wild in 2022.
According to Kaspersky, the updated variant and its associated driver have been identified in attacks targeting organizations in Myanmar, Mongolia, Pakistan and Russia.
The kernel-mode driver significantly enhances the malware’s ability to evade detection. It can hide the COOLCLIENT process, protect associated files and registry entries, and prevent security tools from inspecting or modifying them.
Growing Cyber Espionage Threat in the Region
The emergence of Operation QUICSILVER highlights how cyber espionage groups continue to combine convincing social-engineering lures with legitimate Windows components and custom malware.
The use of official-looking government documents, VHD containers, trusted Microsoft binaries and encrypted network protocols makes the attack chain particularly difficult to identify through traditional security controls.
For organizations in Myanmar and other frequently targeted regions, the campaign underscores the importance of monitoring suspicious LNK files, VHD attachments, unusual use of legitimate Windows utilities and unexpected outbound QUIC traffic.
The activity also demonstrates the continuing evolution of China-linked cyber espionage operations, with attackers increasingly combining relatively simple backdoors with stealth and defense-evasion techniques designed to prolong access to targeted networks.
