Threats Tagged 'china-nexus'

A China-nexus threat actor is targeting Myanmar government personnel and diplomats through Operation QUICSILVER, delivering malware via Virtual Hard Disk files disguised as JPEG images. The campaign uses Burmese-language lures impersonating Myanmar's Information Technology and Cyber Security Department, including graduation ceremony invitations. The multi-stage infection chain begins with a malicious LNK file that abuses ftp.exe to execute scripts, reconstructs payloads from split files, and deploys QUICAgent, a custom Go-based backdoor. The implant retrieves C2 infrastructure through Cloudflare Workers, communicates over HTTP/3 using QUIC protocol, and employs RC4 encryption. Deleted documents recovered from the VHD reveal interest in ASEAN affairs, BIMSTEC, and Myanmar diplomatic activities. Three related campaigns were identified between April and July 2026, sharing similar TTPs and infrastructure.

MediumMalwareMyanmar#vhd file#quic protocol#cloudflare workers

Flying Eagle is an Android remote access tool (RAT) whose source code was leaked in early 2026, leading to a fractured criminal ecosystem with about 170 active servers. The malware is distributed via Telegram channels offering modified versions and operational support, targeting Chinese users primarily with phishing overlays aimed at financial, adult, and government services. A successor platform called Night Dragon was introduced in June 2026, enhancing credential theft capabilities for Chinese banking apps, cryptocurrency wallets, and social media. The threat leverages social engineering and impersonation tactics, including malicious APKs mimicking official Chinese government apps. While primarily focused on China, the platform's templates suggest potential for broader international targeting.

MediumMalwareChinaThailand#mobile banking fraud#spynote#telegram distribution