Operation QUICSILVER used booby-trapped virtual disk files disguised as images and documents to hit government and IT staff, researchers say, deploying a custom backdoor that hides its command servers behind Cloudflare Workers.
Seqrite, the enterprise security arm of Quick Heal Technologies Limited, has disclosed a cyber-espionage campaign, named Operation QUICSILVER, that targets government and information-technology personnel in Myanmar. The company assesses with moderate confidence that the operation is linked to China.
Researchers at Seqrite Labs, which describes itself as India’s largest malware analysis facility, found the campaign while tracking global threat activity. They traced it to at least three related intrusion sets active between April and July 2026. The attackers relied on malicious Virtual Hard Disk (VHD) files made to look like image and document attachments.
Lures aimed at officials and foreign staff
The earliest sample was circulated as a fabricated Belgian-Myanmar public holiday calendar, suggesting the group also wanted to reach foreign personnel, such as embassy and NGO staff, working in Myanmar. Two later VHD samples, disguised as a training announcement image and an ACMECS-themed document, used the same infection chain, payload and command-and-control infrastructure.
The main lure is a formal, Burmese-language invitation to a graduation ceremony, impersonating Myanmar’s Information Technology and Cyber Security Department under the Ministry of Transport and Communications. It refers to two training programmes and carries an official ministry seal, which lends it credibility. Despite its name suggesting a JPEG, the file is a VHD container. Once mounted, it shows a Windows shortcut dressed up with a PDF icon.
How the infection works
Opening the shortcut launches a legitimate, Microsoft-signed Windows binary that is abused to run a hidden script. The script displays the decoy document to distract the victim while using native Windows commands to join two disguised files and rebuild the final payload, which then runs from the user’s local application-data folder.
That payload is a custom backdoor the researchers have named QUICAgent. Before contacting its operators, it runs sandbox-evasion routines, including randomised delays and repeated cryptographic hashing meant to exhaust automated analysis tools. It then finds its live command-and-control address through two Cloudflare Workers endpoints instead of a hardcoded server, making takedown and detection harder.
QUICAgent communicates over QUIC, encrypts traffic with RC4 and checks the server’s certificate against a self-signed certificate authority embedded in the binary. It beacons every five seconds, collects the victim’s hostname and username, and supports five operator commands: remote shell access, file upload, file download, directory listing and beacon-interval control. A shortcut in the Startup folder ensures it relaunches at every login.
Deleted files hint at wider targets
Researchers also recovered several deleted documents left in the VHD’s Recycle Bin, apparently by accident. They included sensitive-looking material on BIMSTEC and ASEAN diplomatic dialogue, a Malaysian foreign-policy assessment on Myanmar, and documents impersonating official Myanmar Ministry of Foreign Affairs communications. Though not delivered to victims, they offer insight into the range of targets and themes the actor may be pursuing. Together with the government-themed lures, regional victimology and observed tactics, they point to China-nexus activity.
Seqrite’s advice
Seqrite said the campaign reflects a wider regional pattern: executables disguised as ordinary files, legitimate signed Windows utilities abused to avoid alerts, and cloud services such as Cloudflare Workers used to make command channels harder to block. It has released detection signatures for the VHD dropper, LNK loader and backdoor components, and continues to monitor the actor’s infrastructure.
“Operation QUICSILVER shows how attackers are combining old tricks with new infrastructure. Seqrite urges government agencies and organisations across South and Southeast Asia to treat unexpected file types - especially disk images posing as documents or photos - with the same scrutiny as executables, and pair that vigilance with layered detection capable of spotting encrypted, dynamically resolved command-and-control traffic,” the company said.
It added that layering existing security with Seqrite Zero Trust Network Access (ZTNA) and Digital Risk Protection Services (DRPS) can help government entities prevent domain impersonation, typosquatting and executive profile clones through dark web exposure monitoring and automated takedowns.
See What’s Next in Tech With the Fast Forward Newsletter
Tweets From @varindiamag
Nothing to see here - yet
When they Tweet, their Tweets will show up here.
