A new cyber espionage campaign dubbed Operation QUICSILVER is targeting Myanmar’s government and tech sectors with a malware backdoor called QUICAgent, according to recent findings. The operation leverages a multi-stage infection chain and disguises its malicious payload inside seemingly harmless files tied to graduation ceremonies. Experts believe the attack stems from a China-linked threat group.([thehackernews.com](https://thehackernews.com/2026/08/operation-quicsilver-targets-myanmar.html))
How the attack unfolds
The campaign was first spotted in April 2026 when threat analysts detected a file named “HolidayNotice.pdf.exe,” presented alongside a fake Belgian–Myanmar public holiday calendar.([thehackernews.com](https://thehackernews.com/2026/08/operation-quicsilver-targets-myanmar.html)) Then, in June and July, the attackers upped the sophistication, using Virtual Hard Disk (VHD) files that kick off the infection sequence.([thehackernews.com](https://thehackernews.com/2026/08/operation-quicsilver-targets-myanmar.html))
Inside each VHD lies a Windows Shortcut (LNK) masquerading as a PDF document. When opened, the decoy displays an invitation to a graduation ceremony in Burmese, purportedly sent by Myanmar’s Information Technology and Cyber Security Department. Meanwhile, the LNK stealthily runs “ftp.exe”—a legitimately signed Microsoft binary—to carry out scripts hidden on the system.([thehackernews.com](https://thehackernews.com/2026/08/operation-quicsilver-targets-myanmar.html))
QUICAgent’s payload & evasion tricks
The next step sees the script merging two faux document files (“header.doc” and “body.doc”) stored in a hidden folder. This merged content reconstructs the QUICAgent payload using Windows’ native copy command.([thehackernews.com](https://thehackernews.com/2026/08/operation-quicsilver-targets-myanmar.html)) Once active, QUICAgent—written in Go—employs sandbox evasion methods: inserting delays between 100–600 ms and running 1,000 cycles of SHA-256 hashing to confuse detection tools.([thehackernews.com](https://thehackernews.com/2026/08/operation-quicsilver-targets-myanmar.html))
Communication with command-and-control (C2) infrastructure is handled smartly: the malware reaches out via HTTP GET to two Cloudflare Workers domains to obtain the C2 server address. It then appends port 443 and uses QUIC over UDP 443 to talk to the malicious infrastructure.([thehackernews.com](https://thehackernews.com/2026/08/operation-quicsilver-targets-myanmar.html)) A beacon is sent every five seconds once infected, each machine identified by a unique X-Agent-ID. QUICAgent allows attackers to run files, collect system data, browse directories, transfer files, and even customize how often the beacons are sent.([thehackernews.com](https://thehackernews.com/2026/08/operation-quicsilver-targets-myanmar.html)) Persistence is handled via a shortcut placed in the user’s Windows Startup folder.([thehackernews.com](https://thehackernews.com/2026/08/operation-quicsilver-targets-myanmar.html))
Connections to other malware & regional threat activity
This campaign aligns with recent activity from the Mustang Panda threat actor, which has deployed an updated COOLCLIENT backdoor supporting a signed kernel-mode driver (“Msagent.sys”), granting stealthier operations via kernel-level tricks.([thehackernews.com](https://thehackernews.com/2026/08/operation-quicsilver-targets-myanmar.html)) Kaspersky assess that this COOLCLIENT version has been used in intrusions in Myanmar, Mongolia, Pakistan, and Russia.([thehackernews.com](https://thehackernews.com/2026/08/operation-quicsilver-targets-myanmar.html))
COOLCLIENT’s capabilities include keylogging, clipboard theft, credential snooping, system reconnaissance, plugin support, and file management. Compared to prior variants, the addition of a kernel-mode driver gives it the ability to conceal processes, protect related files and registry entries, and shield itself against inspection or deletion.([thehackernews.com](https://thehackernews.com/2026/08/operation-quicsilver-targets-myanmar.html))
These operations show a trend: threat actors in the region combining social engineering with creative payload hiding (VHDs, decoys), abusing signed system binaries (LOLBAS), and bringing kernel-mode stealth to their malware.([thehackernews.com](https://thehackernews.com/2026/08/operation-quicsilver-targets-myanmar.html))
Forward-looking security monitoring is crucial. Enterprises and government bodies—especially in Myanmar—should watch for unusual LNK shortcuts or VHD files with documents and ensure signed Windows binaries like ftp.exe are scrutinized closely.
By delivering a custom Go-based backdoor in multiple covert stages and mixing both novel and established attack techniques, Operation QUICSILVER underscores how determined cyber espionage groups continue to evolve. What’s at stake is not just sensitive data but the integrity of national systems and the trust organizations place in foundational OS files and services. Monitoring for early signs and implementing layered defenses—including endpoint hardening and strict execution policies — will be key to limiting damage from this and future campaigns.
