A China-nexus threat actor is targeting Myanmar government personnel and diplomats through Operation QUICSILVER, delivering malware via Virtual Hard Disk files disguised as JPEG images. The campaign uses Burmese-language lures impersonating Myanmar's Information Technology and Cyber Security Department, including graduation ceremony invitations. The multi-stage infection chain begins with a malicious LNK file that abuses ftp.exe to execute scripts, reconstructs payloads from split files, and deploys QUICAgent, a custom Go-based backdoor. The implant retrieves C2 infrastructure through Cloudflare Workers, communicates over HTTP/3 using QUIC protocol, and employs RC4 encryption. Deleted documents recovered from the VHD reveal interest in ASEAN affairs, BIMSTEC, and Myanmar diplomatic activities. Three related campaigns were identified between April and July 2026, sharing similar TTPs and infrastructure.

Indicators of Compromise

• hash: c4b4647795567ab15528edd1ab1bf37fb50e21b442e59a653051061973e87c02
• hash: 5a91a13e681788ab02354f2fc2f82355
• hash: a204bc8249df2b64dfab8181172c25ee
• hash: b9622eb982f7c8b9885c932ca54339a0
• hash: 6e66d673306fc57d6479422e1e8cc17c5dbf94e8
• hash: 9216fcae1736e8ff7cbed130677a52e3daf93dc1
• hash: c06b90b06caf4e2e8d9eeef84c34ca84a2f40fa7
• hash: 0803521a7e9081f46f8f9f61d72371ecc1f49657f10202fffa9a33f581d8bb39
• hash: 26f735cbbb1257be94e6d01656a35bf66a8ae9c34868548d69ec5cb588f9f916
• hash: 4a1a1b1455c3ea91a3d9203ebff025553227302cede6077e821d303655e2c9f2
• hash: 575305cdaeb1d2187ca6d5ebe32f4c3e3fb53f5ccbe1c0cc257a7f71d84e6f35
• hash: aeff39943e254c34187e4a60be3d09d49687439e709eeb4be2b1984310d8ba5c
• hash: cd147efe37003399e174951927e5fe727a4481756b116f0204a14a64cc62b059
• hash: daeac66441b88ba22806f6617058a2dbf1ea0ddcc6c94f291542ea853ac6f9d3
• ip: 38.60.244.141
• domain: maui-cocktailbar.com
• domain: register.mediumser.com