China-Nexus Hackers Target Myanmar Diplomats With QUICAgent Go Backdoor via Malicious VHD Files

A China-nexus threat actor is targeting Myanmar government and diplomatic personnel with a multi-stage malware campaign that delivers a custom Go-based backdoor, dubbed QUICAgent, through Virtual Hard Disk (VHD) files disguised as benign images.

The campaign relies on highly targeted social engineering. One malicious file, named TrainingAnnouncement.jpg, is not an image but a VHD container.

When mounted, it exposes what appears to be a Burmese-language PDF invitation for a graduation ceremony issued by Myanmar’s Information Technology and Cyber Security Department (ITCSD), part of the Ministry of Transport and Communications.

The decoy impersonates an official event notice and uses a ministry seal watermark to increase credibility.

However, the visible “PDF” is actually TrainingAnnouncement.pdf.lnk, a Windows shortcut masquerading behind a PDF icon.

With Windows commonly hiding known file extensions, victims may see only a legitimate-looking document name and icon.

Opening the LNK initiates the infection chain by launching the Microsoft-signed ftp.exe utility with its -s: switch, instructing it to process a local script stored in a file named _.

The script opens the genuine decoy invitation while covertly locating header.doc and body.doc inside a hidden _rels directory.

It then uses the native copy /b command to merge the two disguised components into Windowsupdate.exe under %LOCALAPPDATA%, before launching the reconstructed executable.

This abuse of trusted Windows utilities reduces reliance on overtly malicious tooling and complicates basic detection.

Seqrite identified at least three related campaigns against Myanmar. The earliest, observed in April 2026, used HolidayNotice.pdf.exe and a fabricated Belgian–Myanmar public-holiday calendar, suggesting interest in Belgian organizations operating in Myanmar, including embassies and NGOs.

Seqrite tracks the activity as Operation QUICSILVER and assesses the China nexus with moderate confidence based on victimology, infrastructure, and overlapping tradecraft with its previously documented Operation GriefLure.

Myanmar Diplomats With QUICAgent

Two later VHD samples TrainingAnnouncement.jpg in June and ACMECS_Pillar_1.vhd in July used different decoys but shared the same infection flow, payload family, and command-and-control infrastructure.

QUICAgent is a 64-bit Go 1.20 implant designed for remote access, data collection, and operator tasking.

Before connecting, it introduces short random delays and conducts 1,000 SHA-256 operations, likely attempting to consume automated sandbox execution windows.

It collects the compromised host’s DNS hostname and current username, then beacons at a five-second interval using RC4-encrypted JSON sent through HTTP/3 POST requests.

The backdoor dynamically resolves its backend infrastructure through Cloudflare Workers endpoints before communicating over QUIC on UDP/443.

Seqrite observed the Workers service return register[.]mediumser[.]com, which resolved to 104[.]64[.]211[.]22 during analysis.

QUICAgent also embeds a self-signed “RAT CA” certificate and uses custom certificate-verification logic, allowing operators to control TLS trust rather than depend on default Go validation.

Its command set includes shell, upload, download, list_dir, and set_heartbeat, giving attackers the ability to execute commands, move files, enumerate directories, and tune communications.

Persistence is established through SystemIn.lnk in the current user’s Startup directory, created with a temporary PowerShell script and configured to relaunch Windowsupdate.exe at logon.

Notably, researchers recovered deleted documents from the VHD’s $Recycle.Bin directory. These included material referencing BIMSTEC, ASEAN affairs, Malaysian assessments of Myanmar, and purported Myanmar Ministry of Foreign Affairs documents.

Defenders should inspect VHD attachments disguised as media files, block or scrutinize untrusted LNK execution access, and hunt for ftp.exe launched with local script parameters.

Although the files were not active lures, they suggest an intelligence interest in Myanmar’s diplomatic, regional-policy, and foreign-relations ecosystem.

Monitoring unusual QUIC traffic over UDP/443, Cloudflare Workers lookups, %LOCALAPPDATA%Windowsupdate.exe, and Startup-folder entries such as SystemIn.lnk can help uncover QUICSILVER activity.

IOCs

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

★ Which Security Tools Should You Cut? Score Them on One Page – Download the Inherited Security Stack Guide