Victim

Myanmar government

0 mentions in 7 days · 1 in 30 days · 2 total · first seen Aug 17, 2026 · last 23d ago

Timeline2 articles

Operation QUICSILVER Targets Myanmar Government and IT with QUICAgent Backdoor

Seqrite Labs details Operation QUICSILVER, a China-nexus espionage campaign targeting Myanmar government and IT with graduation-invite lures deploying QUICAgent backdoor.

Seqrite Labs reported Operation QUICSILVER, a cyber espionage campaign against Myanmar's government and IT sectors attributed with moderate confidence to a China-nexus actor. Since April 2026, attacks used fake Belgian-Myanmar holiday and Burmese graduation ceremony invitation lures delivered via VHD/LNK files that abuse ftp.exe (LOLBAS) to assemble and launch QUICAgent, a Go backdoor communicating over QUIC on UDP 443 with five commands and Startup-folder persistence. Separately, China-linked Mustang Panda was observed using an updated COOLCLIENT backdoor with a signed kernel-mode driver across Myanmar, Mongolia, Pakistan, and Russia.

The Hacker NewsAug 24, 11:51 UTC · 23d agoThreat actor in the wild1

Stately Taurus Activity in Southeast Asia Links to Bookworm Malware

Unit 42 links Stately Taurus APT activity in ASEAN region and Myanmar to the decade-old Bookworm malware family via infrastructure overlaps.

Unit 42 connected Stately Taurus (aka Mustang Panda) espionage activity targeting ASEAN-affiliated organizations and Myanmar to the Bookworm malware family, first published in 2015. Earlier attacks delivered the PubLoad stager via DLL sideloading, with a PubLoad variant communicating with C2 at 123.253.32[.]15 while mimicking Windows Update URLs. Three previously unreported loader samples from 2021-2022 used UUID-decoded shellcode loaded via heap allocation and API callbacks, ultimately decrypting and loading Bookworm DLLs. A ToneShell backdoor variant shared debug paths with Bookworm loaders, and the January 2024 CSIRT CTI post corroborated the Myanmar attacks.

Palo Alto Unit 42Aug 17, 10:54 UTC · Aug 17, 2026Threat actor in the wild1

Appears with

product ToneShell 2 threat actor Mustang Panda 2 malware ToneShell 2 malware Bookworm 1 malware COOLCLIENT 1 malware PlugX 1 malware PubLoad 1 malware QUICAgent 1 organization CSIRT CTI 1 organization Lab52 1 organization Ministry of Transport and Communications (Myanmar) 1 organization NCC Group 1 organization Palo Alto Networks 1 organization Unit 42 1 product Bookworm 1 product COOLCLIENT 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.