This campaign targets Myanmar diplomats and government personnel by delivering malware through VHD files masquerading as images. The infection chain starts with a malicious LNK file exploiting ftp.exe to execute scripts that reconstruct payloads from split files. The deployed backdoor, QUICAgent, is a Go-based implant that retrieves C2 addresses via Cloudflare Workers and communicates over HTTP/3 using the QUIC protocol with RC4 encryption. The threat actor uses Burmese-language social engineering lures impersonating official Myanmar IT and Cyber Security entities. Analysis of recovered deleted documents indicates a focus on ASEAN, BIMSTEC, and Myanmar diplomatic activities. Three related campaigns with similar tactics, techniques, and procedures (TTPs) and infrastructure were identified from April to July 2026.

The campaign enables persistent remote access to targeted Myanmar government and diplomatic systems through a custom backdoor, potentially allowing espionage and data exfiltration related to regional diplomatic affairs. The use of advanced communication methods (HTTP/3, QUIC, Cloudflare Workers) and encryption (RC4) complicates detection and analysis. The targeting of government personnel and diplomats suggests a strategic intelligence-gathering operation.

No official patch or remediation guidance is provided. Organizations should be aware of the threat actor's use of VHD files with malicious LNK payloads and social engineering lures in Burmese impersonating Myanmar cybersecurity authorities. Defensive measures should focus on blocking or scrutinizing VHD attachments, monitoring for unusual ftp.exe usage, and detecting QUICAgent backdoor communications, especially those leveraging Cloudflare Workers and HTTP/3 QUIC protocol. Incident response teams should analyze suspicious VHD files carefully and consider network monitoring for RC4-encrypted traffic over HTTP/3. Patch status is not yet confirmed — check vendor advisories and threat intelligence updates for current remediation guidance.