Operation QUICKSILVER uses malicious virtual disk files and a custom Go-based backdoor to target government and IT personnel, according to Seqrite Labs.
Seqrite, the enterprise cybersecurity arm of Quick Heal Technologies, has uncovered a suspected China-linked cyber-espionage campaign targeting government and information technology personnel in Myanmar. Named Operation QUICKSILVER, the campaign uses malicious Virtual Hard Disk (VHD) files disguised as documents and images to deliver a custom backdoor.
Seqrite assesses the campaign as China-nexus activity with moderate confidence. Researchers traced at least three related intrusion sets active between April and July 2026, with lures suggesting potential targeting of foreign personnel, including embassy and non-governmental organisation staff operating in Myanmar.
The primary attack uses a Burmese-language graduation ceremony invitation impersonating Myanmar’s Information Technology and Cyber Security Department. The seemingly legitimate attachment is actually a VHD container that, when mounted, reveals a Windows shortcut disguised with a PDF icon.
“Operation QUICKSILVER shows how attackers are combining disguised files, legitimate Windows utilities and cloud infrastructure to make cyber-espionage harder to detect.”
Executing the shortcut abuses a legitimate Microsoft-signed Windows binary to launch a hidden script. While displaying a decoy document, the script reconstructs and executes QUICAgent, a custom Go-based backdoor identified by Seqrite researchers.
The malware employs sandbox-evasion techniques and dynamically resolves its command-and-control infrastructure through Cloudflare Workers endpoints. Its communications use the QUIC protocol and RC4 encryption. QUICAgent can collect basic victim information, execute remote shell commands, transfer files, list directories and modify its communication interval. A Startup-folder shortcut enables persistence across user logins.
Researchers also recovered deleted documents referencing regional diplomatic discussions involving BIMSTEC and ASEAN, Malaysian foreign policy on Myanmar, and purported Myanmar foreign ministry communications. These artefacts provide additional context but do not independently establish the full scope of targeting.
The campaign highlights the risks posed by disguised file formats, abused legitimate utilities and resilient cloud-based command-and-control infrastructure. Seqrite has released detection signatures for the identified components and recommends scrutinising unexpected disk-image attachments alongside layered monitoring for suspicious encrypted network traffic.