Operation QUICSILVER Uses Disguised VHDs to Target Myanmar Government Personnel
Summary
Seqrite details Operation QUICSILVER, targeting Myanmar government personnel with a disguised VHD lure and Go backdoor QUICAgent. The malware resolves C2 via Cloudflare Workers and uses QUIC with RC4 encryption; Seqrite assesses a China nexus with moderate confidence.
Key points
- The campaign used a Burmese-language government-themed invitation in a VHD disguised as a JPEG to target Myanmar government personnel.
- A malicious LNK launched ftp.exe to run a local script, which combined two disguised files into the QUICAgent payload.
- QUICAgent is a custom Go backdoor with sandbox-evasion behavior and Startup-folder persistence.
- The backdoor resolves its C2 server through Cloudflare Workers and communicates over QUIC on UDP port 443, using RC4-encrypted traffic.
- The implant collects host and username information and supports commands for shell execution, file transfer, directory listing, and beacon-interval changes.
- Seqrite links the campaign to related activity and assesses a China nexus with moderate confidence.
Article Details
- Attack Vectors
- A Burmese-language graduation invitation impersonating Myanmar’s Information Technology and Cyber Security Department was delivered in a VHD file disguised as a JPEG.
- A malicious LNK disguised as a PDF launched ftp.exe with a local script.
- The script combined header.doc and body.doc from a hidden directory to reconstruct and launch Windowsupdate.exe.
- QUICAgent retrieved its C2 hostname through Cloudflare Workers and communicated over QUIC using RC4-encrypted traffic.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | maui-cocktailbar[.]com | Listed by the article among the campaign’s C2 URLs and infrastructure. |
| DOMAIN | register[.]mediumser[.]com | C2 hostname returned by a Cloudflare Workers endpoint and contacted by the malware. |
| IPV4 | 104[.]64[.]211[.]22 | Resolved C2 server contacted by the malware over QUIC. |
| IPV4 | 38[.]60[.]244[.]141 | Historical address of the reported C2 domain, observed from 1 July 2026 to 6 July 2026. |
| SHA256 | 0803521a7e9081f46f8f9f61d72371ecc1f49657f10202fffa9a33f581d8bb39 | Hash of ACMECS_Pillar_1.vhd, a VHD sample reported to share the campaign’s payload and infrastructure. |
| SHA256 | 26f735cbbb1257be94e6d01656a35bf66a8ae9c34868548d69ec5cb588f9f916 | Hash of TrainingAnnouncement.jpg, the VHD sample disguised as a JPEG. |
| SHA256 | 4a1a1b1455c3ea91a3d9203ebff025553227302cede6077e821d303655e2c9f2 | Hash of header.doc, a payload fragment used to reconstruct the backdoor. |
| SHA256 | aeff39943e254c34187e4a60be3d09d49687439e709eeb4be2b1984310d8ba5c | Hash of body.doc, a payload fragment used to reconstruct the backdoor. |
| SHA256 | c4b4647795567ab15528edd1ab1bf37fb50e21b442e59a653051061973e87c02 | Hash of HolidayNotice.pdf.exe, a malicious sample from an earlier related campaign targeting Myanmar. |
| SHA256 | cd147efe37003399e174951927e5fe727a4481756b116f0204a14a64cc62b059 | Hash of Windowsupdate.exe, the QUICAgent backdoor payload. |
| SHA256 | daeac66441b88ba22806f6617058a2dbf1ea0ddcc6c94f291542ea853ac6f9d3 | Hash of the malicious TrainingAnnouncement.pdf.lnk used to initiate the infection chain. |
| URL | hxxps[:]//appupdate[.]0cmds20cj2cdf8[.]workers[.]dev/A3cmf0q9ASCion | Cloudflare Workers endpoint used by the malware to retrieve the backend C2 hostname. |
| URL | hxxps[:]//regupdate[.]eamakfu49dc28wa[.]workers[.]dev/vere0zme82cadre | Cloudflare Workers endpoint used by the malware to retrieve the backend C2 hostname. |
MITRE ATT&CK
T1027.009 · Embedded PayloadsThe script combines header.doc and body.doc to reconstruct Windowsupdate.exe.T1036.008 · Masquerade File TypeThe VHD is disguised as a JPEG, and the LNK uses a PDF name and icon.T1041 · Exfiltration Over C2 ChannelQUICAgent sends RC4-encrypted JSON in HTTP/3 beacon traffic to its C2 server.T1059.001 · PowerShellA local script controls infection steps, and a generated PowerShell script creates the persistence shortcut.T1082 · System Information DiscoveryQUICAgent collects the infected system’s DNS hostname and logged-in username for its initial beacon.T1083 · File and Directory DiscoveryThe script searches the hidden _rels directory for header.doc and body.doc.T1102.001 · Dead Drop ResolverThe malware uses Cloudflare Workers URLs to dynamically obtain the real C2 hostname.T1204.002 · Malicious FileOpening the disguised VHD/LNK file triggers the infection chain.T1218 · System Binary Proxy ExecutionThe LNK launches the legitimate ftp.exe binary to execute commands stored in a local script.T1547.001 · Registry Run Keys / Startup FolderQUICAgent creates SystemIn.lnk in the current user’s Startup folder to run the backdoor at logon.T1566.001 · Spearphishing AttachmentA Burmese-language invitation lure was delivered in a malicious VHD file.
Malware
Products
Cloudflare WorkersThe operation uses a malicious LNK, ftp.exe, split-payload reconstruction, and a Go backdoor named QUICAgent that communicates via Cloudflare Workers and QUIC while using RC4 encryption.Microsoft WindowsAlthough it looked like a PDF document, it was actually a Windows shortcut (LNK) file using a PDF icon to appear legitimate.
Countries
Industries
GovernmentSeqrite tracked Operation QUICSILVER, a China-nexus campaign targeting Myanmar government personnel with a Burmese-language lure delivered in a disguised VHD file.Information TechnologyThe campaign targeted Myanmar government personnel using a formal Burmese invitation impersonating Myanmar’s Information Technology and Cyber Security Department.