China-Linked QUICAgent Malware Targets Myanmar Officials in Operation QUICSILVER

A China-nexus threat actor has launched a targeted cyberespionage campaign against Myanmar government and diplomatic personnel using deceptive government invitations and malicious virtual hard disk (VHD) files.

Security researchers from Seqrite have identified the activity as Operation QUICSILVER, involving a custom Golang-based backdoor named QUICAgent.

The campaign uses Burmese-language documents designed to appear as legitimate communications from Myanmar government institutions, suggesting a highly targeted operation focused on officials and information-technology personnel.

China-Linked QUICAgent Malware

The attackers reportedly impersonate Myanmar’s Information Technology and Cyber Security Department under the Ministry of Transport and Communications.

One of the primary lures is presented as an official invitation to a graduation ceremony associated with government training programs.

The document uses Burmese language and government-style branding, increasing the likelihood that targeted recipients will trust the file and open it.

Researchers believe the operation is primarily focused on Myanmar government and IT-sector personnel, while recovered deleted documents provide additional clues about the threat actor’s potential intelligence priorities.

The attack begins with a file named TrainingAnnouncement.jpg, which is not actually a conventional image. Instead, it is a VHD file disguised by using a .jpg extension.

When the victim opens or mounts the file, it presents what appears to be a PDF named TrainingAnnouncement.pdf. However, the apparent document is actually a malicious Windows shortcut file named TrainingAnnouncement.pdf.lnk.

Because Windows frequently hides known file extensions, victims may see a familiar PDF icon and assume the file is a legitimate government document.

When the malicious shortcut is executed, it launches the legitimate Microsoft-signed ftp.exe utility. The attackers abuse the program’s -s: option to execute commands contained in a local script named _.

This technique allows malicious activity to blend with legitimate Windows utilities and potentially complicates detection based solely on executable reputation.

The script simultaneously opens the Burmese-language decoy invitation to maintain the appearance of normal activity while locating two hidden files named header.doc and body.doc inside an _rels directory.

It then uses the native Windows copy /b command to combine these files and reconstruct a malicious executable named Windowsupdate.exe. The resulting payload is placed in the victim’s %LOCALAPPDATA% directory and executed.

Seqrite also discovered deleted files within the VHD’s Recycle Bin directory. These included documents and materials referencing BIMSTEC, Myanmar’s Ministry of Foreign Affairs, political developments in Malaysia and China, and other diplomatic or regional affairs.

Although the recovered documents were not directly used as part of the infection mechanism, their presence provides important intelligence about the information that may interest the operators behind Operation QUICSILVER.

The final payload, Windowsupdate.exe, is a 64-bit executable written in Go 1.20 and functions as the QUICAgent backdoor.

The malware introduces a short execution delay between approximately 100 and 600 milliseconds and performs 1,000 SHA-256 hashing operations.

Such behavior may be intended to complicate automated sandbox analysis or evade security systems that monitor malware behavior immediately after execution.

QUICAgent obtains its command-and-control infrastructure through Cloudflare Workers URLs and communicates using QUIC over UDP port 443 and HTTP/3 POST requests.

During analysis, researchers observed an endpoint associated with register[.]mediumser[.]com, which resolved to 104[.]64[.]211[.]22. Using modern web protocols can help malicious communications resemble legitimate encrypted internet traffic, potentially making network-based detection more challenging.

The campaign demonstrates the continuing evolution of targeted cyberespionage operations, where threat actors combine social engineering, disguised VHD files, legitimate Windows utilities, custom malware, and modern network protocols.

Organizations handling diplomatic or government information should strengthen email and attachment filtering, restrict unauthorized mounting of disk-image files, monitor suspicious use of trusted system utilities, and deploy endpoint detection capable of identifying unusual process chains.

Security teams should also monitor for the published indicators of compromise and investigate unexpected QUIC or HTTP/3 communications originating from sensitive endpoints.