Operation QUICSILVER Hides a Myanmar Espionage Backdoor Inside a Fake Government Invitation

Threat intelligence report

Deck: A VHD disguised as a JPEG, a PDF-looking Windows shortcut, ftp.exe, split payload files and QUIC over UDP 443 combine into a precise espionage chain.

Reporting cutoff: 2026-08-24T18:44:00Z

Seqrite’s APT team has disclosed Operation QUICSILVER, a cyber-espionage campaign targeting government and information-technology personnel in Myanmar with a custom Go backdoor called QUICAgent.^[1]

Seqrite assesses the operation as China-nexus with moderate confidence based on victimology, shared builder artifacts, overlapping techniques and recovered diplomatic-themed files.^[1] That is a vendor intelligence assessment—not proof of Chinese-government sponsorship, a named unit or an identified individual.

The most important technical lesson reaches beyond Myanmar: QUICAgent communicates over HTTP/3 using QUIC on UDP port 443, a protocol path that can bypass HTTP inspection where security gateways handle TCP but not UDP.^[1][6]

The campaign at a glance

Three related campaigns—not a disclosed victim count

Seqrite says it tracked three related campaigns over several months:^[1]

1. April 2026: HolidayNotice.pdf.exe, paired with a fabricated Belgian–Myanmar public-holiday calendar. Seqrite says the lure suggests possible targeting of Belgian organizations operating in Myanmar, such as embassies or NGOs—but the report does not provide a confirmed victim roster.^[1][2]
2. June 2026: TrainingAnnouncement.jpg, which was actually a Virtual Hard Disk rather than a JPEG.^[1]
3. July 2026: ACMECS_Pillar_1.vhd, using a different lure but sharing the infection chain, payload and command infrastructure.^[1]

These are three related campaign artifacts or waves. They are not three confirmed compromised organizations, and Seqrite did not publish a victim count.

Stage 1: a JPEG that is really a mounted disk

The analyzed file was named TrainingAnnouncement.jpg, but its size and file type identified it as a VHD.^[1]

Once mounted, the disk displayed what appeared to be TrainingAnnouncement.pdf. It was actually TrainingAnnouncement.pdf.lnk with a PDF icon. Because Windows commonly hides known file extensions, the victim could see a familiar PDF-looking name rather than the shortcut’s full extension.^[1]

The lure was carefully localized. It presented a Burmese-language graduation invitation purporting to come from Myanmar’s Information Technology and Cyber Security Department under the Ministry of Transport and Communications.^[1]

The invitation referenced two training programs and an event at a government building in Naypyidaw. Seqrite says it displayed an official-looking ministry seal as a watermark.^[1]

A subtle calendar inconsistency

The invitation reportedly described 3 July 2026 as a Saturday.^[1] Calendar verification shows that date was a Friday. That discrepancy may be a useful phishing-review clue, but it is not enough by itself to classify a document as malicious.

Stage 2: ftp.exe launches the hidden script

Opening the shortcut launches Microsoft’s signed ftp.exe utility. The malicious LNK supplies the -s: option, telling ftp.exe to execute commands from a local text file named _.^[1]

This matters because the attacker did not need a visibly exotic first-stage executable. The chain used a legitimate Windows binary as a proxy for scripted execution.

The script first opened the legitimate decoy PDF, keeping the user occupied. It then found two files—header.doc and body.doc—inside a hidden _rels directory and combined them with the native Windows copy /b operation.^[1]

The reconstructed binary was written to %LOCALAPPDATA% as Windowsupdate.exe and immediately launched.^[1]

The .doc filenames were camouflage. Seqrite’s analysis says the two files were split pieces of the executable, not ordinary Word documents.^[1]

Stage 3: QUICAgent takes control

Seqrite identified Windowsupdate.exe as a 64-bit Windows program built with Go 1.20 and named the implant QUICAgent.^[1]

Before making its main command connection, the implant performs two anti-analysis actions:

• a randomized delay between 100 and 600 milliseconds;
• 1,000 SHA-256 hashing iterations intended to consume automated sandbox time.^[1]

These actions may defeat short or shallow automated runs. They do not make the backdoor intrinsically invisible to a properly instrumented endpoint or sufficiently long sandbox session.

How command infrastructure is discovered

QUICAgent does not rely only on a fixed command-server address embedded in the binary. It sends HTTP GET requests to two Cloudflare Workers endpoints. A response supplies the current backend hostname, after which the implant constructs the destination on port 443.^[1]

MITRE ATT&CK calls this pattern a dead-drop resolver: a legitimate external web service stores information that points infected systems toward separate C2 infrastructure.^[5]

Seqrite observed one Workers endpoint returning register[.]mediumser[.]com, which resolved during analysis to 104[.]64[.]211[.]22. Historical DNS examined by Seqrite showed a previous address, 38[.]60[.]244[.]141, from July 1 through July 6, followed by the move on July 7.^[1]

Cloudflare’s infrastructure was abused as a retrieval layer. The finding does not mean Cloudflare created, endorsed or knowingly operated the malware campaign.

Why QUIC matters

QUIC is a legitimate secure transport standardized in RFC 9000. It carries packets in UDP datagrams and encrypts as much of each packet as practical.^[4]

QUICAgent used HTTP/3 over QUIC on UDP port 443 for its command channel.^[1]

That creates a visibility problem when an organization’s controls assume web traffic is TCP-based. Cloudflare’s own Gateway documentation states that HTTP/3 inspection requires a UDP proxy; without one, HTTP/3 traffic bypasses HTTP inspection even though underlying network policies can still apply.^[6]

QUIC itself is not malicious. Blocking every QUIC connection can degrade legitimate applications and force protocol fallback. The defensive question is whether the organization can:

• inventory and inspect outbound UDP/443;
• distinguish managed-browser QUIC from unusual endpoint processes;
• correlate QUIC traffic with process, file, DNS and identity telemetry;
• force TCP fallback in environments where QUIC-aware inspection is unavailable.

Microsoft provides an enterprise Edge policy named QuicAllowed; disabling that policy blocks QUIC in Edge and requires a browser restart.^[7] Organizations should test any broad protocol restriction before deployment and apply it through managed policy rather than ad-hoc user changes.

Layered encryption and certificate validation

Seqrite found a hardcoded PEM certificate in the backdoor. The embedded self-signed CA used the name RAT CA and organization RAT System. QUICAgent used custom peer-certificate validation rather than relying only on Go’s default trust handling.^[1]

Seqrite also reported that the malware encrypted its JSON task traffic with RC4 before transmitting it inside the QUIC channel.^[1]

The presence of an additional RC4 layer does not make RC4 modern or strong cryptography. In this campaign it is an obfuscation layer inside an already encrypted transport.

What QUICAgent sends and receives

Before its first command beacon, QUICAgent collects:

• the infected computer’s DNS hostname;
• the currently logged-in username.^[1]

The default beacon interval is five seconds. The server returns an X-Agent-ID used to identify the infected host.^[1]

The implant supports five task types:

Seqrite observed that the task names were represented through 64-bit constants rather than stored as ordinary plaintext command strings in the binary.^[1]

QUICAgent’s command set is compact, but it is sufficient for interactive access, file theft, tool deployment and follow-on operations. A capability list does not prove every command ran against every target.

Persistence through the Startup folder

QUICAgent creates a temporary PowerShell script named like create_lnk_*.ps1. That script creates SystemIn.lnk in the current user’s Startup folder, pointing to Windowsupdate.exe.^[1]

The result is per-user logon persistence: when that user signs in again, the backdoor starts automatically.

Deleted documents and attribution boundaries

Seqrite recovered deleted PDFs from the VHD’s Recycle Bin. The documents referenced ASEAN, BIMSTEC, UN meetings, Myanmar diplomacy, Malaysian foreign-policy assessments and purported Myanmar Ministry of Foreign Affairs material.^[1]

Seqrite explicitly says those deleted documents were not directly associated with the analyzed delivery and were not delivered to victims.^[1] They offer context about possible intelligence interests, not proof that every document was authentic, stolen from a victim or used in an intrusion.

The report also found the builder hostname desktop-stv6gg in the malicious LNK. Seqrite had previously observed the same hostname in Operation GriefLure, along with a similar ftp.exe and split-payload chain.^[1]

Seqrite’s conclusion is China-nexus with moderate confidence.^[1] The article does not elevate that assessment to a specific government sponsor, APT name, nationality or physical location.

Indicators defenders can use

Seqrite published eight SHA-256 file hashes and six defanged network indicators.^[1] The complete defensive list is included in the accompanying IOC ledger.

High-value endpoint leads include:

• a VHD with a .jpg display name;
• TrainingAnnouncement.pdf.lnk masquerading as a PDF;
• ftp.exe launched with -s: and a local script;
• copy /b joining header.doc and body.doc;
• %LOCALAPPDATA%\Windowsupdate.exe;
• temporary create_lnk_*.ps1 files;
• SystemIn.lnk in a user Startup folder;
• Go 1.20 binary metadata;
• LNK builder hostname desktop-stv6gg;
• repeated outbound QUIC/UDP 443 from an unexpected non-browser process.^[1][3]

A filename alone is not proof. Verify path, hash, signer, parent process, command line, creation time and surrounding network behavior.

What organizations should do now

Restrict risky disk-image delivery

Block or quarantine unsolicited VHD/VHDX attachments and downloads where business use is uncommon. Log disk-image mounting and execution originating from mounted volumes.

Show full file extensions

Displaying full extensions makes TrainingAnnouncement.pdf.lnk harder to mistake for a PDF. This is a supporting control—not a replacement for endpoint detection or user training.

Monitor ftp.exe as an execution proxy

Alert when ftp.exe:

• launches from or reads scripts on mounted/removable volumes;
• uses -s: with an unusual local file;
• spawns or is followed by PowerShell, cmd.exe or an unsigned executable;
• appears in users or departments that do not normally use command-line FTP.^[3]

Hunt the reconstruction and persistence chain

Search endpoint telemetry for copy /b, header.doc, body.doc, Windowsupdate.exe, create_lnk_*.ps1 and SystemIn.lnk. Correlate these with mounted VHD activity and shortcut execution.

Close the QUIC visibility gap

Inventory outbound UDP/443 and identify which products actually inspect HTTP/3. If HTTP/3 inspection is unavailable, consider a tested managed policy that forces supported browsers back to TCP, while preserving exceptions required for business applications.^[6][7]

Do not rely only on network destinations. Cloud-service dead drops and rotating backend addresses reduce the lifetime of domain and IP blocks.

Isolate and preserve before cleanup

If multiple indicators align:

1. Isolate the endpoint from the network.
2. Preserve volatile and endpoint evidence before deleting files.
3. Capture mounted-volume history, process trees, shortcut metadata, Startup-folder contents, PowerShell logs and outbound UDP/443 telemetry.
4. Hunt for the same artifacts across peer systems and accounts.
5. Reset credentials and revoke sessions based on incident scope—not solely on a filename match.
6. Rebuild or restore affected systems according to the organization’s incident-response standard.

What remains unknown

Public reporting does not establish:

• the number of targeted people or compromised systems;
• a named victim organization;
• the original delivery channel for every lure;
• a specific Chinese government sponsor or threat group;
• whether every related sample used every QUICAgent capability;
• what data was actually stolen;
• whether the reported command infrastructure remains active at this cutoff;
• whether the deleted diplomatic documents were authentic, collected, staged or copied from another source.

Bottom line

Operation QUICSILVER is not technically notable because it uses one previously unknown trick. Its strength comes from combining familiar controls and blind spots: a believable government lure, misleading extensions and icons, mounted-disk delivery, a signed Windows utility, split payload pieces, user-level persistence, a cloud-hosted dead-drop resolver and HTTP/3 over QUIC.^[1]

For most organizations, the practical defense is correlation. A VHD mount, PDF-looking LNK, scripted ftp.exe, binary reconstruction, Startup-folder shortcut and non-browser UDP/443 beacon are far more meaningful together than any one artifact viewed alone.

Sources

1. Operation QUICSILVER: China-Nexus Actor Targets Myanmar Diplomats via VHD-Delivered Go Backdoor

   “We assess this activity to be China-nexus with moderate confidence.”

   “The implant supports five commands that allow the operator to execute commands, transfer files, browse directories, and control the beacon interval.”

2. Operation QUICSILVER Targets Myanmar Government and IT with QUICAgent Backdoor

   “It was first observed in April 2026, when the attack was observed delivering a file named "HolidayNotice.pdf.exe" along with a lure that was a fabricated Belgian–Myanmar public holiday calendar.”

3. Operation QUICSILVER Targets Myanmar with Go Backdoor

   “Organizations should restrict execution of untrusted LNK files”

4. RFC 9000: QUIC: A UDP-Based Multiplexed and Secure Transport

   “QUIC is a secure general-purpose transport protocol.”

5. MITRE ATT&CK T1102.001: Dead Drop Resolver

   “Adversaries may use an existing, legitimate external Web service to host information that points to additional command and control (C2) infrastructure.”

6. Cloudflare: HTTP/3 inspection

   “HTTP/3 uses the QUIC protocol over UDP instead of TCP.”

7. Microsoft Edge policy: QuicAllowed

   “If you disable this policy, the QUIC protocol is blocked.”