Full Report
Cybersecurity researchers have flagged a cyber espionage campaign targeting Myanmar that uses graduation ceremony invitation lures to deliver a Go backdoor called QUICAgent. The campaign, codenamed Operation QUICSILVER, has been found to target government and information technology sectors, per Seqrite Labs. The activity is assessed to be the work of a China-nexus threat actor with moderate
Analysis Summary
# Threat Actor: Unnamed China-Nexus Actor (Operation QUICSILVER)
## Attribution & Identity
* **Actor Name:** Unnamed China-nexus threat actor.
* **Confidence Level:** Moderate confidence.
* **Associated Groups:** While the article discusses Mustang Panda (HoneyMyte) in a similar context regarding Myanmar, Operation QUICSILVER is treated as a distinct activity attributed generally to a China-nexus group.
## Activity Summary
* **Operation QUICSILVER (April – July 2026):** A multi-stage cyber espionage campaign targeting Myanmar.
* **April 2026:** Initial wave using a fake Belgian–Myanmar public holiday calendar lure ("HolidayNotice.pdf.exe").
* **June – July 2026:** Transitioned to using Virtual Hard Disk (VHD) files containing malicious LNK files mimicking graduation invitations.
## Tactics, Techniques & Procedures
* **Phishing & Lures:** Use of localized lures (Burmese language) themed around diplomatic calendars and graduation invitations from the Ministry of Transport and Communications.
* **Living off the Land (LOLBAS):** Abuse of the legitimate Microsoft-signed binary `ftp.exe` with the `-s` flag to execute local scripts.
* **Payload Construction:** Reconstructing the final backdoor by combining two hidden files (`header.doc` and `body.doc`) using the native Windows `copy /b` command.
* **Anti-Analysis & Evasion:**
* Random execution delays (100-600ms).
* CPU-intensive operations (1,000 iterations of SHA-256) to exhaust sandbox timeout limits.
* **Network Protocol:** Utilization of the **QUIC protocol** over UDP port 443 for C2 communication to bypass traditional TCP-based inspections.
* **Persistence:** Establishing an LNK file in the Windows Startup folder.
* **MITRE ATT&CK Techniques:**
* T1204.002 (User Execution: Malicious File)
* T1218 (System Binary Proxy Execution: ftp.exe)
* T1027 (Obfuscated Files or Information - payload reconstruction)
* T1547.001 (Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder)
* T1071.001 (Application Layer Protocol: Web Protocols)
## Targeting
* **Sectors:** Government and Information Technology (IT) sectors.
* **Geography:** Myanmar.
* **Victims:** Specifically targeting diplomats and personnel associated with the Information Technology and Cyber Security Department (ITCSD) under the Ministry of Transport and Communications.
## Tools & Infrastructure
* **Malware Families:**
* **QUICAgent:** A custom Golang-based backdoor supporting remote command execution, file transfer, and directory browsing.
* **Infrastructure:**
* **Cloudflare Workers:** Used for dynamic retrieval of the C2 address.
* **C2 Server:** `104.64.211[.]22`
* **Domains:** Hosted via Cloudflare (specific worker URLs not fully detailed but used for initial redirection).
## Implications
This actor demonstrates a high degree of regional focus and technical adaptation. The shift to using the QUIC protocol and Golang-based implants suggests an evolving toolkit designed to evade network security appliances that primarily monitor TCP traffic. The targeting of Myanmar’s IT security infrastructure indicates a strategic objective to compromise the very departments responsible for national cyber defense.
## Mitigations
* **Endpoint Monitoring:** Monitor for unusual executions of `ftp.exe`, especially those utilizing the `-s` parameter to run local scripts.
* **File Analysis:** Block or scrutinize the mounting of Virtual Hard Disk (`.vhd`, `.vhdx`) files from untrusted sources, particularly via email or web downloads.
* **Network Filtering:** Inspect UDP port 443 traffic for non-standard QUIC signatures and monitor connections to known Cloudflare Worker infrastructure used for C2 redirection.
* **User Training:** Educate government employees on the risks of opening unexpected invitation lures, even those appearing to originate from official domestic departments.