Cybersecurity researchers have uncovered a new cyber espionage campaign, **Operation QUICSILVER**, specifically targeting entities within Myanmar. This operation employs highly convincing social engineering tactics, primarily using fake graduation ceremony invitations to deliver a potent Go-based backdoor known as **QUICAgent**. ### Targeting Myanmar's Critical Sectors According to **Seqrite Labs**, the campaign focuses on both government and information technology sectors within Myanmar. The threat actor, believed to be linked to China with moderate confidence, demonstrates a clear intent for espionage and data exfiltration. ### Evolution of Attack Vectors **Operation QUICSILVER** was first observed in April 2026, initially using a fabricated Belgian–Myanmar public holiday calendar as a lure to deliver a malicious executable, "HolidayNotice.pdf.exe". Subsequent attacks in June and July 2026 evolved, leveraging Virtual Hard Disk (**VHD**) files to initiate the infection chain. ### Deceptive Lures and Execution Flow The **VHD** files contain a malicious Windows Shortcut (**LNK**) file disguised as a PDF document. When opened, this **LNK** file displays a decoy PDF – an official-looking graduation ceremony invitation in Burmese, ostensibly from Myanmar's Information Technology and Cyber Security Department (**ITCSD**).  Crucially, while the victim views the decoy, the **LNK** file stealthily abuses `ftp.exe`, a legitimate **Microsoft**-signed Windows binary. It leverages the `-s` option to execute commands stored in a local script file. Security researchers **Priya Patel** and **Kartik Jivani** detailed the process: "While the decoy is presented on the victim's screen, the script searches for two document files, header.doc and body.doc, stored inside the hidden _rels directory. It then combines these two files using the native Windows `copy /b` command to reconstruct the next-stage payload." ### QUICAgent: A Stealthy Go Backdoor The reconstructed payload is **QUICAgent**, a Golang-based implant designed with sandbox evasion techniques. It incorporates a random delay of 100-600 milliseconds and executes 1,000 iterations of SHA-256 hashing operations to exhaust automated sandbox execution time limits, hindering analysis.  **QUICAgent** dynamically retrieves its command-and-control (**C2**) server address by sending HTTP GET requests to **Cloudflare Workers** domains. Once the **C2** address (e.g., `104.64.211[.]22`) is obtained, it communicates via **QUIC** over **UDP port 443**. The backdoor sends basic compromised host information every five seconds, assigning a unique `X-Agent-ID` to each victim. **QUICAgent** supports core functionalities such as executing commands, transferring files, browsing directories, and modifying its beacon interval. Persistence is achieved by placing an **LNK** file in the user's Windows Startup folder. ### Broader Context: Mustang Panda and COOLCLIENT This disclosure comes amidst observations of another China-linked threat actor, **Mustang Panda**, deploying an updated version of their **COOLCLIENT** backdoor. This new variant can deploy a signed kernel-mode driver, `Msagent.sys`, similar to kernel-mode enhancements seen in **TONESHELL**. **COOLCLIENT** is typically deployed via **PlugX** using **DLL sideloading** and offers extensive capabilities, including keylogging, clipboard theft, credential harvesting, file management, and system reconnaissance. **Kaspersky** noted that this updated **COOLCLIENT** variant and its accompanying driver have been detected in intrusions across Myanmar, Mongolia, Pakistan, and Russia, significantly enhancing its stealth capabilities by hiding processes and protecting related files and registry entries from inspection or modification. Security professionals and privacy-conscious users should remain vigilant against such sophisticated, multi-stage attacks that leverage trusted binaries and social engineering to bypass defenses.