Do Son 
Infection Chain
At a glance
| Actor or group | Unnamed China-nexus actor (moderate confidence) |
| Activity type | Cyber espionage, custom Go backdoor |
| Targets | Myanmar government and IT personnel |
| Scale | Three related campaigns tracked since April 2026 |
| Status | Active; no arrests reported |
| Source | Seqrite APT Team |
TL;DR
Seqrite uncovered a new espionage campaign it calls Operation QUICSILVER. The campaign hides malware inside a Virtual Hard Disk file disguised as a JPEG. It ends with a custom Go backdoor named QUICAgent that talks to its C2 server over QUIC.
What happened
Seqrite’s APT team found a sample called TrainingAnnouncement.jpg. However, the file was far too big for a real image. A quick check revealed the truth. The file was actually a Virtual Hard Disk.
Inside sat a single decoy. It looked like a PDF, yet it was a Windows shortcut wearing a PDF icon. The lure impersonated Myanmar’s Information Technology and Cyber Security Department. It invited victims to a graduation ceremony written in Burmese.
When a victim opens the shortcut, the infection starts. The Operation QUICSILVER chain then abuses ftp.exe, a signed Microsoft binary, to run a hidden script. That script quietly rebuilds the real payload on disk.
How the payload is built
The script combines two disguised files, header.doc and body.doc. Next, it uses the native copy /b command to stitch them together. The result becomes Windowsupdate.exe. As Seqrite explains, the script “combines these two files using the native Windows copy /b command to reconstruct the next-stage payload.” Finally, the malware launches right away.
Inside the QUICAgent backdoor
The final payload is a 64-bit Windows binary written in Go 1.20. Seqrite named it QUICAgent. Before it phones home, the backdoor stalls sandboxes. It adds a short random delay and runs 1,000 rounds of SHA-256 hashing.
The backdoor then finds its server in a clever way. It sends a request to two Cloudflare Workers URLs. Each reply returns the real C2 hostname in plain text. Because of this trick, defenders cannot spot a fixed address in the binary.
After that, QUICAgent connects over QUIC on UDP port 443. It protects traffic with RC4 encryption and a hardcoded key. The malware also carries an embedded self-signed certificate named “RAT CA” under the organization “RAT System.” It supports five commands, including shell access, file transfer, and directory listing.
How it stays put
QUICAgent keeps its foothold through a Startup shortcut. First, it writes a temporary PowerShell script. Then that script creates SystemIn.lnk in the user’s Startup folder. As a result, the backdoor runs at every login.
Who is behind it
Seqrite attributes Operation QUICSILVER to a China-nexus actor with moderate confidence. The team based this on shared tooling and victim focus. Notably, the same builder hostname, “desktop-stv6gg,” appeared in an earlier campaign called Operation GriefLure from May 2026.
Deleted files also told a story. Investigators recovered documents from the VHD Recycle Bin that the actor left behind by mistake. These touched on ASEAN affairs, BIMSTEC, and Myanmar’s diplomacy. One was even marked “Confidential – For Official Use Only.”
Wider context
China-aligned actors have long targeted Myanmar. Groups like Mustang Panda have hit its ministries for years, often through DLL side-loading and LNK lures. Operation QUICSILVER fits that pattern, yet it adds a fresh Go backdoor and modern QUIC traffic.
Impact and scale
Seqrite tracked three linked campaigns since April 2026. The earliest used a fake Belgian-Myanmar holiday calendar. Two later VHD samples shared the same payload and infrastructure. So far, no arrests or official victim counts exist.
What comes next and how to stay protected
The campaign remains active, so defenders should act now. Treat unexpected VHD or disk-image files with suspicion. Block ftp.exe from running scripts where you can. Also monitor for QUIC traffic on UDP 443 to unusual hosts.
Teams should hunt for the listed C2 domains and check Startup folders for stray shortcuts. Operation QUICSILVER shows how attackers blend trusted tools with new protocols. Careful monitoring gives you the best chance to catch it early.
Support Our Threat Intelligence
If you find our CVE report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
