A China-nexus threat actor has launched a campaign, tracked by Seqrite as ‘Operation QUICSILVER,’ targeting Myanmar government personnel with a custom Go-based backdoor delivered via a Virtual Hard Disk (VHD) file.
The campaign uses a Burmese-language graduation ceremony invitation, presented as an official document from Myanmar’s Information Technology and Cyber Security Department, as a lure. The infection chain begins with a malicious Windows shortcut (LNK) disguised as a PDF file.
When opened, the LNK abuses ftp.exe, a legitimate Microsoft-signed Windows utility, as a living-off-the-land binary. Its -s: option is used to run commands stored in a local script named _, which has no file extension. The final stage of the attack involves the deployment of the QUICAgent backdoor.
QUICAgent collects basic system information and sends it in an initial beacon. It supports five operator commands, including command execution, file transfer, directory browsing, and control of the beacon interval. The malware discovers its command-and-control (C&C) server via Cloudflare Workers and communicates over HTTP/3 using the QUIC protocol. RC4 encryption is used to protect C&C traffic.
Researchers also recovered files from the VHD's Recycle Bin that appear to have been accidentally left behind by the attacker.
Operation QUICSILVER is part of a wider series of campaigns targeting Myanmar, researchers said. A previous campaign observed in April 2026 used HolidayNotice.pdf.exe and a fake Belgian–Myanmar public holiday calendar, potentially targeting Belgian organizations operating in Myanmar. Two later VHD samples, TrainingAnnouncement.jpg from June and ACMECS_Pillar_1.vhd from July, used different lures but shared the same infection chain, payload, and C&C infrastructure.
The combination of overlapping tactics, techniques and procedures (TTPs), infrastructure, malware, and victim targeting led Seqrite to assess the activity as China-nexus with moderate confidence.