Skip to content

Operation QUICSILVER: VHD-delivered Go backdoor targets Myanmar diplomats

Summary

Seqrite Labs (coverage via The Hacker News, August 24, 2026; original analysis August 17, 2026) documented Operation QUICSILVER, an espionage campaign attributed with moderate confidence to a China-nexus actor targeting Myanmar government and IT interests — specifically entities tied to the ITCSD (Information Technology Centre for Sustainable Development) under Myanmar's Ministry of Transport and Communications — first observed around April 2026. The campaign delivers a new Go-based backdoor, QUICAgent, through double-extension LNK files that point at VHD containers, and communicates over QUIC (UDP/443) to infrastructure behind Cloudflare Workers discovery domains.

Tags

Campaign chain

  • Lure: early deliveries used HolidayNotice.pdf.exe alongside a fake Belgian–Myanmar holiday calendar; from June/July 2026 the actor shifted to VHD files containing LNK decoys — notably a Burmese-language fake graduation invitation attributed to the ITCSD.
  • Execution: the LNK launches ftp.exe -s with a script file (LOLBAS). The script reconstructs the payload by binary-copying hidden OOXML parts — _rels/header.doc and body.doc — via copy /b into the final executable.
  • Payload: the rebuilt implant is the Go-based QUICAgent backdoor.
  • Sandbox evasion: the implant applies a randomized 100–600 ms delay at startup and burns CPU with ~1000× SHA-256 computations before beaconing.
  • C2: discovery domains resolve to Cloudflare Workers; beaconing goes to 104.64.211[.]22 on port 443 over QUIC/UDP, with a ~5 second beacon interval and a unique X-Agent-ID per host. The observed command set comprises five commands.
  • Persistence: an LNK placed in the Startup folder re-executes the chain at logon.

Assessment limits

  • Attribution to a China-nexus actor is moderate confidence per Seqrite; Myanmar government/IT targeting is based on lure content (ITCSD branding, Burmese-language materials), not victim confirmation beyond the reported set.
  • No public KEV listing, vendor advisory, or law-enforcement confirmation exists as of the August 24, 2026 writeup.
  • The campaign first observed April 2026; the published writeup describes activity through early August 2026, so earlier lures and infrastructure may differ.

Defender heuristics

  1. Treat double-extension LNK files as hostile by default, especially ones referencing .vhd, .vhdx, or Office document names; the LNK → VHD hop with ftp.exe -s script execution is the durable IOC shape for this campaign.
  2. Hunt the reassembly pattern: copy /b of _rels/header.doc + body.doc inside an OOXML container producing an executable, and any ftp.exe spawning with -s script arguments (LOLBAS).
  3. Watch for QUIC/UDP C2: outbound UDP 443 beacons with short intervals and a stable per-host header are not typical of normal client traffic; the 104.64.211[.]22 endpoint and Cloudflare-Workers-fronted discovery domains are the current infrastructure.
  4. Review LNK Startup persistence on hosts that opened any Myanmar-government-themed document, and check for the startup delay + repeated SHA-256 burn pattern (sandbox-evasion artifact) in process telemetry.
  5. Sector relevance: Myanmar diplomatic, government, and IT-adjacent organizations and their regional correspondents should treat Burmese-language invitation/graduation/holiday-themed attachments as presumed malicious.

Sources