Answer Brief
Cybersecurity researchers have identified Operation QUICSILVER, a China-nexus espionage campaign targeting Myanmar’s government and IT sectors since April 2026. The attack uses fake graduation ceremony invitations to deliver QUICAgent, a Go-based backdoor that abuses legitimate Windows binaries and communicates via QUIC over UDP port 443 to evade detection.
Signal Timeline
A quick visual path for analysts before reading the full brief.
- 1
First observed attack using HolidayNotice.pdf.exe and Belgian–Myanmar public holiday calendar lure
- 2
Detection of VHD file-based attack chain
- 3
Second VHD file-based artifact detected
- 4
Public disclosure by Seqrite Labs via The Hacker News
Executive Summary: Cybersecurity researchers have identified Operation QUICSILVER, a China-nexus espionage campaign targeting Myanmar’s government and IT sectors since April 2026. The attack uses fake graduation ceremony invitations to deliver QUICAgent, a Go-based backdoor that abuses legitimate Windows binaries and communicates via QUIC over UDP port 443 to evade detection.
Why It Matters
Operation QUICSILVER represents a sophisticated, multi-stage cyber espionage campaign specifically targeting Myanmar’s government and information technology infrastructure, with activity first observed in April 2026. The campaign’s use of socially engineered lures—such as fake graduation ceremony invitations purporting to come from Myanmar’s Information Technology and Cyber Security Department—demonstrates a deep understanding of local administrative rhythms and trusted communication channels. By crafting lures in Burmese and mimicking official government correspondence, the attackers significantly increase the likelihood of successful initial compromise, particularly among civil servants and IT personnel who may be accustomed to receiving such notifications.
Technically, the infection chain is notable for its abuse of legitimate Windows binaries, a hallmark of living-off-the-land-basics (LOLBAS) techniques. The malware leverages ftp.exe, a Microsoft-signed binary, to execute malicious commands via its '-s' option, thereby bypassing application control policies that might otherwise block unknown executables. This is followed by a payload reconstruction process where two benign-looking document files (header.doc and body.doc) are combined using the native Windows copy /b command to form the next-stage QUICAgent backdoor. This method avoids disk writes of obvious malicious content, further evading signature-based and behavioral detection mechanisms.
Technical Signal
QUICAgent itself is designed for stealth and persistence. Before establishing contact with its command-and-control server, the implant performs sandbox evasion through timing-based delays and CPU-intensive hashing operations, effectively raising the cost of automated analysis. Once active, it communicates over QUIC—a modern, encrypted transport protocol running over UDP port 443—which allows it to mimic legitimate HTTPS traffic while avoiding TCP-based inspection tools commonly deployed in enterprise networks. The use of Cloudflare Workers domains to dynamically retrieve the C2 IP address adds a layer of resilience and obfuscation, making infrastructure takedowns more difficult.
The assessment of a China-nexus threat actor, while noted with moderate confidence, is contextualized by recent activity from groups like Mustang Panda, which has been observed deploying enhanced backdoors such as COOLCLIENT with signed kernel-mode drivers in intrusions across Myanmar, Mongolia, Pakistan, and Russia. Although Operation QUICSILVER does not appear to use kernel-mode components, its focus on persistence via Windows Startup LNK files, command execution, file transfer, and directory browsing aligns with broader espionage objectives seen in regional campaigns. The targeting of Myanmar’s IT and government sectors suggests an interest in gathering intelligence on internal communications, infrastructure planning, and potentially cross-border coordination.
Operational Impact
For global cybersecurity and AI security teams, this campaign underscores the importance of monitoring for abuse of legitimate binaries, anomalous use of QUIC or UDP 443 for internal communications, and socially engineered lures that mimic local governmental or institutional communications. Organizations operating in or with ties to Southeast Asia should consider enhancing email and endpoint security with behavioral analytics capable of detecting unusual script execution, LNK file abuse, and unexpected outbound QUIC traffic. Additionally, threat intelligence feeds should be monitored for indicators related to QUICAgent, including the C2 IP 104.64.211.22 and associated Cloudflare Worker domains used in the attack chain.
The operational value of this report lies in its utility as a regional signal for organizations with exposure in Myanmar or similar geopolitical contexts. Rather than implying global impact, the disclosure serves as actionable intelligence for local risk assessment, enabling security teams to validate whether observed tactics—such as LNK-based execution chains, QUIC-based C2, or socially engineered lures mimicking government communications—appear in their own telemetry. This approach supports calibrated response without over-attribution, preserving the integrity of the source’s findings while enhancing situational awareness for regional operations, partners, and supply chain monitoring.
What To Watch
Monitoring teams should prioritize verification of local exposure through log reviews for anomalous ftp.exe usage, unexpected LNK execution from user directories, or outbound QUIC traffic on port 443 to unfamiliar endpoints. The presence of decoy documents displaying legitimate-looking content while executing malicious payloads in the background warrants scrutiny of file execution patterns that deviate from normal user behavior, particularly around administrative or ceremonial announcements. Furthermore, the dynamic C2 retrieval mechanism via Cloudflare Workers necessitates monitoring for HTTP GET requests to ephemeral domains that resolve to changing IP addresses, a tactic increasingly favored by threat actors seeking to evade static blocklists.
The campaign’s reliance on social engineering highlights the need for enhanced user awareness training focused on verifying the authenticity of seemingly official communications, especially those tied to seasonal or cultural events like graduation ceremonies. Technical controls should be complemented by procedural checks, such as validating sender domains and cross-referencing announcements through official channels, to reduce the success rate of lure-based initial access.
From a strategic perspective, Operation QUICSILVER exemplifies the evolving tradecraft of China-nexus actors in refining multi-stage infection chains that balance stealth, persistence, and operational flexibility. While lacking the kernel-mode stealth enhancements seen in related tools like COOLCLIENT, QUICAgent’s use of QUIC protocol and LOLBAS abuse reflects a deliberate effort to minimize detection surface while maintaining reliable access. This adaptation suggests an ongoing effort to align tooling with defensive blind spots in enterprise environments, particularly those under-instrumented for UDP/QUIC monitoring or LOLBAS anomaly detection.
For intelligence analysts and threat hunters, the campaign offers a baseline for comparing future intrusions in the region. Recurrence of similar lure themes (e.g., event-based invitations), payload reconstruction techniques, or QUIC-based C2 infrastructure could indicate either campaign evolution or convergent tradecraft among actors targeting Southeast Asian governmental entities. Maintaining visibility into these patterns supports longitudinal tracking of actor behavior and informs adaptive defense planning.
Ultimately, the strength of this disclosure resides not in asserting broad impact, but in providing a granular, source-grounded view of specific tactics, techniques, and procedures observed in the wild. By preserving the boundaries of what is documented—such as the April 2026 onset, the specific lure types, and the technical details of QUICAgent—security teams can use this intelligence as a calibrated reference point for hypothesis-driven hunting, control validation, and regional risk prioritization without overreach.
Event Type: security
Importance: high
Affected Companies
- Kaspersky
- Seqrite Labs
Affected Sectors
- government
- information technology
Key Numbers
- Initial observation: April 2026
- C2 server IP: 104.64.211.22
- Beacon interval: every five seconds
- Sandbox evasion delay: 100-600 milliseconds
- SHA-256 iterations for evasion: 1,000
Timeline
- First observed attack using HolidayNotice.pdf.exe and Belgian–Myanmar public holiday calendar lure
- Detection of VHD file-based attack chain
- Second VHD file-based artifact detected
- Public disclosure by Seqrite Labs via The Hacker News
Frequently Asked Questions
What is QUICAgent and how does it evade detection?
QUICAgent is a Golang-based backdoor used in Operation QUICSILVER that evades sandbox detection by incorporating a random delay of 100-600 milliseconds and executing 1,000 iterations of SHA-256 hashing to exhaust automated analysis time limits before connecting to its C2 server.
How does Operation QUICSILVER deliver its malware to victims in Myanmar?
The campaign uses social engineering lures, such as fake graduation ceremony invitations and fabricated holiday calendars, to trick victims into opening malicious files. These lures trigger a multi-stage infection chain that abuses legitimate Windows binaries like ftp.exe to execute the QUICAgent payload.
What communication protocol does QUICAgent use, and why is it significant for evasion?
QUICAgent uses the QUIC protocol over UDP port 443 to communicate with its command-and-control server, which helps evade network-based detection by blending with legitimate HTTPS traffic and avoiding traditional TCP-based monitoring.
Which sectors in Myanmar are targeted by Operation QUICSILVER, and what is the assessed origin of the threat actor?
Operation QUICSILVER targets Myanmar’s government and information technology sectors. The activity is assessed with moderate confidence to be the work of a China-nexus threat actor, based on analysis by Seqrite Labs and contextual similarities to known groups like Mustang Panda.