Operation QUICSILVER Targets Myanmar Government and IT with QUICAgent Backdoor
Summary: Seqrite Labs reported Operation QUICSILVER, a campaign using graduation ceremony invitation lures to deliver a Go backdoor called QUICAgent against Myanmar government and IT sectors, assessed with moderate confidence to be a China-nexus actor and first observed in April 2026 with a file named "HolidayNotice.pdf.exe". The chain uses a VHD containing a PDF-mimicking LNK that launches Microsoft-signed ftp.exe to run a script, which rebuilds the payload from header.doc and body.doc in a hidden _rels directory before QUICAgent beacons to a C2 server over QUIC on UDP port 443 every five seconds.
Why it matters: The implant burns 1,000 SHA-256 iterations and a 100-600 millisecond delay specifically to outlast automated sandbox time limits, so a detonation window measured in seconds may never see the beacon at all.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026