Operation QUICSILVER: New Go Backdoor Targets Myanmar Government and IT Sectors

Cybersecurity researchers have uncovered a cyber espionage campaign targeting Myanmar government and IT sectors, dubbed Operation QUICSILVER. The campaign, first observed in April 2026, uses graduation ceremony invitation lures to deliver a Go-based backdoor named QUICAgent, according to Seqrite Labs.

The attack chain begins with a malicious LNK file hidden inside a Virtual Hard Disk (VHD) that mimics a PDF document. When opened, the victim sees a decoy PDF—an official-looking graduation invitation from Myanmar’s Information Technology and Cyber Security Department (ITCSD)—while the LNK file silently executes a legitimate Microsoft-signed binary (ftp.exe) to run commands from a local script. The script combines two hidden document files (header.doc and body.doc) using the Windows copy /b command to reconstruct the final payload.

QUICAgent is a Golang-based implant that performs sandbox evasion by introducing random delays and executing thousands of SHA-256 hashing operations. It retrieves its command-and-control (C2) server address dynamically via Cloudflare Workers domains, then communicates over QUIC on UDP port 443. The malware supports five commands for executing commands, transferring files, browsing directories, and modifying beacon intervals. Persistence is achieved by placing an LNK file in the Windows Startup folder.

The campaign is attributed to a China-nexus threat actor with moderate confidence. In related news, the China-linked Mustang Panda group has been observed using an updated version of the COOLCLIENT backdoor that deploys a signed kernel-mode driver (Msagent.sys) to enhance stealth, similar to TONESHELL. Kaspersky detected this variant in intrusions across Myanmar, Mongolia, Pakistan, and Russia.