Operation QUICSILVER Targets Myanmar Government and IT with QUICAgent Backdoor
Seqrite Labs details Operation QUICSILVER, a China-nexus espionage campaign targeting Myanmar government and IT with graduation-invite lures deploying QUICAgent backdoor.
Seqrite Labs reported Operation QUICSILVER, a cyber espionage campaign against Myanmar's government and IT sectors attributed with moderate confidence to a China-nexus actor. Since April 2026, attacks used fake Belgian-Myanmar holiday and Burmese graduation ceremony invitation lures delivered via VHD/LNK files that abuse ftp.exe (LOLBAS) to assemble and launch QUICAgent, a Go backdoor communicating over QUIC on UDP 443 with five commands and Startup-folder persistence. Separately, China-linked Mustang Panda was observed using an updated COOLCLIENT backdoor with a signed kernel-mode driver across Myanmar, Mongolia, Pakistan, and Russia.
- Lures impersonate Myanmar ITCSD graduation ceremony invitations
- VHD with LNK file triggers LOLBAS abuse of ftp.exe
- QUICAgent beacons every 5 seconds over QUIC/UDP 443
- Sandbox evasion via random delays and SHA-256 iterations
- Mustang Panda enhanced COOLCLIENT with kernel-mode driver
- ATT&CK
- T1566.001 Spearphishing AttachmentT1204.001 Malicious LinkT1218 System Binary Proxy ExecutionT1547.001 Registry Run Keys / Startup FolderT1095 Non-Application Layer Protocol
- Vendors
- Seqrite LabsKaspersky
- Threat actors
- Mustang PandaChina-nexus threat actor
- Organizations
- Ministry of Transport and Communications (Myanmar)
From the original article
3 min read at thehackernews.com
Ravie Lakshmanan Aug 24, 2026 Cyber Espionage / Cyber Attack Cybersecurity researchers have flagged a cyber espionage campaign targeting Myanmar that uses graduation ceremony invitation lures to deliver a Go backdoor called QUICAgent. The campaign, codenamed Operation QUICSILVER , has been found to target government and information technology sectors, per Seqrite Labs.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.