Cybersecurity researchers have linked a targeted espionage effort against Myanmar to a campaign that delivers the QUICAgent backdoor using graduation ceremony invitation lures. The operation, dubbed Operation QUICSILVER, focuses on government and information technology-related targets, and uses a multi-stage delivery flow designed to look convincing to victims while quietly preparing the real payload.
First observed in April 2026, the activity shows a clear pattern: a carefully crafted decoy document appears to be part of a legitimate event, while the underlying files orchestrate execution of the next stage. Over the following months, analysts identified additional artifacts that follow the same general approach, including the use of Virtual Hard Disk (VHD) containers.
How the graduation lure leads to QUICAgent backdoor
The initial attacks were spotted delivering an item with a deceptive name: “HolidayNotice.pdf.exe”. Alongside it, the lure incorporated a fabricated Belgian–Myanmar public holiday calendar. While the filename and context try to trigger curiosity, the real goal is to get the victim to open a file that starts a chain of actions.
Later findings in June and July 2026 shifted to a VHD-based method. Inside the VHD, a Windows Shortcut file (LNK) is crafted to mimic a PDF document. When a victim opens what looks like the document, the screen displays a decoy—an official-looking graduation ceremony invitation written in Burmese and attributed to the ITCSD (Information Technology and Cyber Security Department) under Myanmar’s Ministry of Transport and Communications.
The decoy functions as a distraction: it keeps the user occupied while the shortcut file starts executing the next steps in the background.
Abusing a legitimate Microsoft-signed binary
Instead of using a clearly malicious executable, the chain leverages ftp.exe, a legitimate Microsoft-signed Windows utility. The LNK file hides the transition by launching the tool in a way that abuses its command handling behavior. Specifically, it uses the -s option to run commands taken from a local script file.
As described by the researchers, once the decoy is visible, the script looks for two document files named header.doc and body.doc inside a hidden `_rels` directory. It then rebuilds the next-stage payload by combining the two files using the native Windows copy /b technique.
QUICAgent: a Go-based implant with sandbox evasion
After the reconstructed stage is prepared, the campaign deploys a custom implant referred to as the QUICAgent backdoor. Analysts describe it as being written in Go and having a focus on operational security and execution reliability.
Before the backdoor connects externally, it performs sandbox evasion tactics. One part of this strategy includes a randomized delay between 100 and 600 milliseconds. In addition, the malware runs 1,000 iterations of SHA-256 hashing operations, which can slow down automated analysis tools that enforce strict time limits.
This combination aims to make automated environments less likely to capture meaningful behavior during short observation windows.
Getting command-and-control dynamically via Cloudflare Workers
Rather than hard-coding a single command-and-control endpoint, the QUICAgent workflow retrieves the backend address dynamically. The backdoor sends an HTTP GET request to two Cloudflare Workers domains, which return information used to build the final destination.
Once the address is obtained—reported as 104.64.211[.]22—the malware appends port 443 to form where it should communicate. Communication with the command server is then carried out using QUIC over UDP on port 443.
To establish a stable foothold, the initial beacon includes basic information about the compromised machine. The beacon repeats every five seconds, and each infected system is labeled with a unique X-Agent-ID value so the operators can distinguish targets.
What QUICAgent can do once it’s running
Researchers characterize QUICAgent as relatively straightforward in functionality. It supports a limited set of commands that enable core backdoor activities such as:
- Executing commands on the host
- Transferring files
- Browsing directories
- Adjusting the interval for future beacons
While the feature set described is not expansive, the combination of stealth techniques (including sandbox evasion and staged delivery) helps explain how the attackers can sustain access and gather operational value.
Persistence using a startup shortcut
To ensure the backdoor runs after reboot, the campaign sets up an LNK file in the current user’s Windows Startup folder. This means the shortcut will execute automatically the next time the user logs in, maintaining continuity without requiring the user to repeat the phishing action.
In other words, the graduation invitation decoy is the initial trigger, while the startup shortcut provides long-term access.
Related activity: COOLCLIENT and kernel-mode enhancements
The reporting around Operation QUICSILVER also references other China-linked intrusion activity. In particular, researchers note observations of an updated variant of a known backdoor called COOLCLIENT, which can deploy a signed kernel-mode driver named Msagent.sys.
Analysts describe similarities to kernel-mode enhancements previously associated with TONESHELL-style techniques. In the intrusions mentioned, the backdoor is assessed to be delivered via PlugX, using DLL sideloading, a method frequently abused by the group.
COOLCLIENT’s capabilities are broad, including keylogging, clipboard theft, credential harvesting, file management, system discovery, and plugin-based extensions. Researchers also indicate that the malware supports hiding behaviors—such as concealing the COOLCLIENT process and protecting related files and registry entries—making it harder for analysts or tools to inspect the system.
Why this campaign stands out
What makes this intrusion chain notable is the way it mixes believable social engineering with layered execution tactics. The graduation ceremony invitation lure is not just a single stage; it’s paired with a structured workflow that reconstructs the next payload from components stored inside a hidden directory.
At the same time, the malware’s Go-based design and execution delays suggest the attackers aim to survive common automated analysis environments. Finally, the dynamic command retrieval via Cloudflare Workers reduces the risk of simple blocking or static indicator-based defenses.
Conclusion
The QUICAgent backdoor campaign under Operation QUICSILVER demonstrates how attackers can turn an event-themed decoy into an effective multi-stage delivery mechanism. By combining graduation invitation lures, LNK-triggered execution through legitimate tools, payload reconstruction from split document files, and sandbox-aware behavior, the attackers create a chain that is both convincing to victims and resilient under observation.
For defenders, the main takeaway is that social engineering lures should be treated as the front door, not the whole story. Monitoring for the specific staged artifacts—VHD contents, shortcut-triggered execution patterns, and QUIC-based communications to dynamically resolved endpoints—can help detect this type of operation earlier.
Source: https://thehackernews.com/2026/08/operation-quicsilver-targets-myanmar.html
