QUICAgent Backdoor Targets Myanmar Government in Multi-Stage Espionage Campaign
Researchers at Seqrite Labs have uncovered a cyber espionage operation targeting Myanmar's government and IT sectors, using fake graduation ceremony invitations to drop a custom Go-based backdoor. They're calling it Operation QUICSILVER, and the attribution points toward a China-linked threat actor, though Seqrite stops short of high confidence on that.
The campaign was first spotted in April 2026, initially delivered via a file masquerading as a PDF holiday notice. Later samples, picked up in June and July, switched to Virtual Hard Disk (VHD) files as the delivery vehicle. Inside each VHD sits a Windows shortcut file dressed up to look like a PDF. Open it, and the victim gets shown a convincing decoy: an official-looking graduation ceremony invitation in Burmese, supposedly from Myanmar's Information Technology and Cyber Security Department.
While the target is distracted by that document, the LNK file quietly invokes ftp.exe, a legitimate, Microsoft-signed Windows binary. Using its -s flag, it runs commands from a local script. The script then hunts for two files, header.doc and body.doc, tucked inside a hidden directory, and stitches them together using the native Windows copy /b command to reconstruct the actual payload. It's a tidy trick for slipping past signature-based detection.
That payload is QUICAgent, a Golang implant with a couple of sandbox-evasion tricks baked in. It introduces a random delay between 100 and 600 milliseconds at startup and runs 1,000 SHA-256 hash iterations, the latter designed to burn through the time limits that automated sandbox environments typically enforce. Not groundbreaking, but functional.
C2 addresses aren't hardcoded. Instead, QUICAgent fires an HTTP GET request to a pair of Cloudflare Workers domains to retrieve the actual server address dynamically, then communicates with that server over QUIC on UDP port 443. Using QUIC here is clever: the protocol blends into normal encrypted traffic and is increasingly awkward for network monitoring tools to inspect.
Each infected machine gets a unique X-Agent-ID and beacons home every five seconds with basic host information. The backdoor itself isn't especially sophisticated. Five commands cover executing instructions, moving files, browsing directories, and tweaking the beacon interval. Persistence is handled simply by dropping an LNK into the Windows Startup folder.
Separately, Kaspersky has flagged an updated variant of COOLCLIENT, a backdoor associated with the China-linked Mustang Panda group. This version ships with a signed kernel-mode driver, Msagent.sys, that hides the COOLCLIENT process, shields related files and registry keys, and blocks inspection or tampering. The technique mirrors kernel-mode additions seen in TONESHELL, another tool in Mustang Panda's kit.
COOLCLIENT has been around since 2022 and has always been capable: keylogging, clipboard theft, credential harvesting, file management, and plugin support. The kernel driver just makes it considerably harder to detect or remove. Kaspersky found the updated variant in intrusions across Myanmar, Mongolia, Pakistan, and Russia, with delivery via PlugX using DLL sideloading, a Mustang Panda staple.
Whether QUICSILVER and the updated COOLCLIENT campaign are connected remains unclear, but both are actively targeting Myanmar, and both show the continued appetite for quiet, persistent access to government systems in the region.