"It then combines these two files using the native Windows copy /b command to reconstruct the next-stage payload," security researchers Priya Patel and Kartik Jivani said.
Operation QUICSILVER: who is being targeted
Seqrite Labs has named a cyber espionage campaign Operation QUICSILVER after researchers traced a multi-stage backdoor delivery chain that specifically targets Myanmar’s government and information technology sectors. The activity was first observed in April 2026 and, according to Seqrite Labs, is assessed with moderate confidence to be the work of a China-nexus threat actor.
Graduation invitations and fake holidays: the lures used
The operation begins with social-engineering lures that imitate official materials. The first observed sample, in April 2026, delivered a file named "HolidayNotice.pdf.exe" accompanied by a fabricated Belgian–Myanmar public holiday calendar. Later artifacts, detected in June and July 2026, employed a Virtual Hard Disk (VHD) file that activates the same infection chain.
Inside the VHD is a Windows Shortcut (LNK) crafted to resemble a PDF document. When opened, the shortcut displays a decoy PDF — an official-looking graduation ceremony invitation written in Burmese and purporting to come from the Information Technology and Cyber Security Department (ITCSD), which operates under Myanmar’s Ministry of Transport and Communications. The displayed decoy is a distraction while the shortcut triggers the stealthy execution chain.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildAbuse of ftp.exe and payload reconstruction
The infection abuses a legitimate Microsoft-signed binary, "ftp.exe," launching it with the "-s" option to run commands stored in a local script file. While the victim views the decoy PDF, the script searches inside a hidden _rels directory for two files named header.doc and body.doc. "It then combines these two files using the native Windows copy /b command to reconstruct the next-stage payload," Priya Patel and Kartik Jivani wrote.
Persistence is established by placing an LNK file in the current user's Windows Startup folder so the malicious shortcut will be executed the next time the user logs in.
QUICAgent: a Go-based backdoor using QUIC transport
The reconstructed payload is a Golang-based implant Seqrite Labs calls QUICAgent. Before initiating network activity the implant performs deliberate sandbox-evasion behavior: a randomized delay between 100 and 600 milliseconds followed by 1,000 iterations of SHA-256 hashing designed to exhaust automated sandbox execution time limits.
QUICAgent retrieves the backend command-and-control (C2) server dynamically by issuing an HTTP GET request to two Cloudflare Workers domains. The resolved address — recorded in the research as "104.64.211[.]22" — is then suffixed with port 443 to form the final destination. The malware communicates using QUIC over UDP port 443.
The initial beacon contains basic information about the compromised host and is transmitted every five seconds. Each infected machine is assigned a unique X-Agent-ID. Seqrite Labs describes QUICAgent as functionally modest: it supports five commands for tasks that include executing commands, transferring files, browsing directories, and modifying the beacon interval.
Related activity: kernel-mode driver and COOLCLIENT updates
The disclosure was published alongside separate observations by Kaspersky of activity attributed to the China-linked Mustang Panda actor. Kaspersky reported Mustang Panda using an updated variant of a backdoor called COOLCLIENT that can deploy a signed kernel-mode driver named "Msagent.sys" — a capability the company compared to kernel-mode enhancements previously identified in TONESHELL.
Kaspersky said the updated COOLCLIENT variant appears deployed via PlugX using DLL sideloading. The researchers wrote that the driver improves stealth by hiding the COOLCLIENT process, protecting related files and registry entries, and preventing them from being inspected or modified. COOLCLIENT — first detected in 2022, per Kaspersky — supports keylogging, clipboard theft, credential harvesting, file management, system reconnaissance, and plugin-based extensions. Kaspersky reported detections of the updated variant and its driver across intrusions in Myanmar, Mongolia, Pakistan, and Russia.
What this means for Myanmar’s ITCSD, government and security teams, and threat analysts
- Myanmar’s Information Technology and Cyber Security Department (ITCSD): The lure used in the attack impersonates the ITCSD itself; the department should assume spoofed official documents are in circulation and validate inbound materials from unexpected sources.
- Government and IT security teams: Defenders need to watch for LNK files delivered in VHDs, abuse of signed Microsoft binaries such as ftp.exe with the "-s" option, and reconstruction of payloads from hidden document fragments (header.doc and body.doc) in a _rels directory.
- Threat intelligence and CERT teams: The campaign’s use of Cloudflare Workers to resolve a C2 and QUIC over UDP 443 for communications suggests analysts will need telemetry that can inspect QUIC flows and track the specific resolved C2 address ("104.64.211[.]22") tied to the observed incidents.
Operation QUICSILVER combines social engineering, living-off-the-land binary abuse, and a compact Go implant that prefers QUIC transport, while parallel reporting shows a trend toward kernel-mode stealth in other China-linked activity. The record in these discoveries raises a focused question for defenders: will network and endpoint controls surface QUICAgent’s dynamic Cloudflare Workers-based C2 resolution and its QUIC-over-UDP traffic before the campaign expands its reach?
