A recent cyber espionage campaign linked to China has been targeting Myanmar’s government and technology sectors. The attackers employ a deceptive tactic by disguising a virtual hard disk (VHD) file as a JPEG image, aiming to trick recipients into opening it without suspicion.
Upon mounting the VHD, users encounter what appears to be an official Burmese-language graduation invitation from Myanmar’s Information Technology and Cyber Security Department. This seemingly legitimate document serves as a lure, while hidden components within the VHD initiate the installation of a remote access tool known as QUICAgent.
Security analysts at Seqrite have identified this operation as “Operation QUICSILVER” and attribute it to a China-linked threat actor with moderate confidence. The campaign’s lures also include fabricated holiday notices and documents related to the Ayeyawady-Chao Phraya-Mekong Economic Cooperation Strategy (ACMECS), indicating a focus on government and diplomatic personnel.
Deceptive Techniques and Infection Chain
The initial file presents itself with a JPEG-like name but is significantly larger than a typical image file. Further analysis reveals that it is, in fact, a VHD. When opened, the VHD displays a single file that appears to be a PDF document, complete with a corresponding icon. However, this apparent PDF is actually a Windows shortcut (LNK) file. Due to Windows’ default behavior of hiding known file extensions, recipients may not notice the true nature of the file.
Upon clicking the shortcut, it executes the signed Windows utility ftp.exe, which runs commands from a local script. This script opens the decoy invitation document to maintain the illusion of legitimacy while simultaneously reconstructing and executing the QUICAgent payload in the user’s local application-data folder.
QUICAgent’s Functionality and Evasion Tactics
QUICAgent is a custom 64-bit Go-based backdoor designed with evasion techniques to avoid detection. It includes deliberate delays and computational tasks to thwart automated analysis tools. Instead of hardcoding its command-and-control (C2) server address, QUICAgent queries Cloudflare Workers pages to retrieve the active C2 address, enhancing its adaptability and resilience.
The backdoor communicates over the QUIC protocol on UDP port 443, employing RC4 encryption to secure its traffic. Once established, QUICAgent collects system information, such as the computer’s DNS name and the logged-in username. It checks in with the C2 server every five seconds by default and can execute commands, transfer files, list directories, or adjust its check-in interval. To maintain persistence, QUICAgent creates a shortcut in the user’s Startup folder, ensuring it runs upon user login.
This campaign underscores the evolving sophistication of cyber threats, particularly those employing social engineering and file deception techniques. Organizations should exercise caution with unexpected disk-image files, restrict or monitor VHD mounting where unnecessary, and educate staff to be wary of unsolicited documents, especially those claiming to be official or time-sensitive.
