Full Report
Contents Introduction Key Targets Industries Affected Geographical focus Infection Chain Campaign Timeline Initial Findings Looking into the Decoy Document Technical Analysis Stage 1 – LNK-Based Initial Access Stage 2 – Split Payload Reconstruction via ftp Script Stage 3 – QUICAgent Implant – Go-Based Backdoor Infrastructure & Attribution Conclusion SEQRITE Protection Indicators of Compromise (IOCs) MITRE […] The post Operation QUICSILVER: China-Nexus Actor Targets Myanmar Diplomats via VHD-Delivered Go Backdoor appeared first on Seqrite Labs.
Analysis Summary
# Threat Actor: Operation QUICSILVER Actor (China-Nexus)
## Attribution & Identity
* **Identification:** China-nexus threat actor.
* **Aliases/Associated Groups:** Currently tracked via the campaign name "Operation QUICSILVER."
* **Confidence Level:** Moderate confidence in China-nexus attribution based on TTP overlaps, infrastructure artifacts, and victimology.
## Activity Summary
The actor has been active in mid-2026, conducting a series of campaigns targeting diplomatic and government entities in Southeast Asia.
* **April 2026:** Distributed `HolidayNotice.pdf.exe`, using a fabricated Belgian-Myanmar holiday calendar.
* **June 2026:** Distributed `TrainingAnnouncement.jpg` (a VHD file) using a Burmese-language graduation ceremony invitation as a lure.
* **July 2026:** Distributed `ACMECS_Pillar_1.vhd` targeting regional economic cooperation frameworks.
## Tactics, Techniques & Procedures
* **Initial Access:** Phishing via spear-phishing attachments (VHD and LNK files) [T1566.001].
* **Execution:** User execution of malicious LNK files disguised as PDFs [T1204.002].
* **Payload Delivery:** Use of Virtual Hard Disk (VHD) files to bypass security scanners and masquerade file types [T1036.008].
* **Living-off-the-Land (LotL):** Use of the native `ftp.exe` utility to reconstruct split payloads (Stage 2) [T1218].
* **Evasion:** RC4 encryption for C2 traffic and obfuscation of files [T1027.009].
* **C2 Mechanism:** Use of Cloudflare Workers as a Dead Drop Resolver to retrieve the actual C2 address [T1102.001].
* **Persistence:** Boot or Logon Autostart Execution via Registry Run keys [T1547.001].
## Targeting
* **Sectors:** Government, Information Technology, Diplomatic Missions, and NGOs.
* **Geography:** Myanmar (primary); likely targeting entities involved with Malaysia and Belgium.
* **Victims:** Personnel associated with Myanmar’s Ministry of Transport and Communications (MOTC), Myanmar’s Information Technology and Cyber Security Department (ITCSD), and the Myanmar Institute of Strategic and International Studies (MISIS).
## Tools & Infrastructure
* **Malware:**
* **QUICAgent:** A custom Golang-based backdoor that communicates over HTTP/3 using the QUIC protocol.
* **Infrastructure:**
* **Dead Drop Resolvers:** `appupdate[.]0cmds20cj2cdf8[.]workers[.]dev`, `regupdate[.]eamakfu49dc28wa[.]workers[.]dev`
* **C2 Domains:** `register[.]mediumser[.]com`, `maui-cocktailbar[.]com`
* **IP Addresses:** `38[.]60[.]244[.]141`, `104[.]64[.]211[.]22`
## Implications
This actor demonstrates a high degree of interest in Burmese internal affairs and regional diplomacy (ASEAN, ACMECS, BIMSTEC). The use of the QUIC protocol and Cloudflare Workers indicates a sophisticated approach to bypassing traditional network traffic inspection. The presence of "accidentally" deleted sensitive documents within the VHDs suggests the actor is actively handling and weaponizing real diplomatic intelligence stolen from previous victims.
## Mitigations
* **VHD/ISO Blocking:** Disallow the mounting of VHD and ISO files from email attachments or unknown web downloads via GPO.
* **Scripting Restrictions:** Restrict or monitor the use of `ftp.exe` and `cmd.exe` for unexpected network connections or file reconstructions.
* **Network Monitoring:** Monitor for unusual HTTP/3 (QUIC) traffic to non-standard domains or Cloudflare Worker subdomains.
* **Endpoint Protection:** Deploy solutions capable of detecting LNK-based execution and Go-based implants (QUICAgent).