Operation QUICSILVER Targets Myanmar Government and IT with QUICAgent Backdoor
Operation QUICSILVER is a China-nexus cyber espionage campaign targeting Myanmar's government and IT sectors using social engineering lures disguised as graduation ceremony invitations The attack deploys QUICAgent, a Golang-based backdoor that uses sandbox evasion (SHA-256 hashing loops and random delays) and communicates via QUIC protocol over UDP port 443 The multi-stage infection chain abuses a legitimate Windows binary (ftp.exe) as a LOLBAS to reconstruct and execute the payload from fragmen
Analysis
TL;DR
- Operation QUICSILVER is a China-nexus cyber espionage campaign targeting Myanmar's government and IT sectors using social engineering lures disguised as graduation ceremony invitations
- The attack deploys QUICAgent, a Golang-based backdoor that uses sandbox evasion (SHA-256 hashing loops and random delays) and communicates via QUIC protocol over UDP port 443
- The multi-stage infection chain abuses a legitimate Windows binary (ftp.exe) as a LOLBAS to reconstruct and execute the payload from fragmented document files hidden in a VHD file
- A separate but related development involves Mustang Panda using an updated COOLCLIENT backdoor with a signed kernel-mode driver (Msagent.sys) for enhanced stealth across Myanmar, Mongolia, Pakistan, and Russia
Why It Matters
This campaign highlights the growing sophistication of China-linked threat actors targeting Southeast Asian government infrastructure, combining social engineering with advanced evasion techniques to establish persistent access. The use of legitimate Windows binaries (LOLBAS) and kernel-mode drivers demonstrates an escalating arms race in stealth capabilities that security teams must account for in their detection and response strategies.
Technical Details
- Infection Chain: VHD file containing a malicious LNK shortcut that mimics a PDF, displays a decoy graduation invitation, and silently executes
ftp.exe -sto run a script that reconstructs the QUICAgent payload fromheader.docandbody.docfiles in a hidden_relsdirectory usingcopy /b - Sandbox Evasion: QUICAgent implements a random delay (100-600ms) and 1,000 iterations of SHA-256 hashing to exhaust automated sandbox execution time limits before initiating C2 communication
- C2 Communication: Dynamically resolves C2 server address via HTTP GET requests to two Cloudflare Workers domains, then connects to
104.64.211:443using QUIC over UDP; each beacon includes host information and a uniqueX-Agent-IDassigned every 5 seconds - QUICAgent Capabilities: Five core commands — execute commands, transfer files, browse directories, modify beacon interval, and basic host reconnaissance; persistence via LNK file in Windows Startup folder
- COOLCLIENT Update: Mustang Panda's updated backdoor now deploys a signed kernel-mode driver (
Msagent.sys) that hides processes, protects files and registry entries from inspection, and extends capabilities to keylogging, clipboard theft, credential harvesting, and plugin-based extensions via PlugX DLL sideloading
Industry Insight
- Security teams should prioritize monitoring for LOLBAS abuse patterns involving
ftp.exe -sand unusual VHD file activity, as these techniques bypass traditional signature-based detection and require behavioral monitoring - The shift toward kernel-mode drivers for process hiding signals an escalation in APT operational security; endpoint detection solutions must incorporate kernel-level visibility and integrity monitoring to counter this trend
- Organizations in Myanmar and the broader Southeast Asian region should conduct targeted threat hunts for QUICAgent indicators and COOLCLIENT artifacts, while reviewing email and document handling policies to mitigate socially engineered lures targeting government and IT personnel
Disclaimer: The above content is generated by AI and is for reference only.