Nation-stateAug 24, 2026

Operation QUICSILVER Targets Myanmar Government and IT with QUICAgent Backdoor

Operation QUICSILVER targets Myanmar with QUICAgent backdoor, linked to China-nexus actor.

A cyber espionage campaign named Operation QUICSILVER has been targeting Myanmar's government and IT sectors, utilizing a Go-based backdoor called QUICAgent. The campaign, observed since April 2026, employs sophisticated multi-stage infection chains, including VHD files and abusing legitimate Windows binaries like ftp.exe, to deploy the malware. Researchers assess it to be the work of a China-nexus threat actor.

AI summary of the linked source. Not reviewed by an editor. How this works

Read at source

Vendor Watch

Run Seqrite Labs?

Get an email when a new story names Seqrite Labs, usually within the hour.

Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch works Privacy

The lesson from this incident

Full lesson

Operation QUICSILVER demonstrates how sophisticated threat actors leverage legitimate Windows binaries (such as ftp.exe) and unconventional delivery mechanisms (VHD files) to evade traditional defenses — a technique known as Living-off-the-Land (LotL). The abuse of trusted system tools makes detection significantly harder, as security controls often whitelist these binaries by default. The use of the QUIC protocol for command-and-control further complicates network-level detection since QUIC traffic is encrypted and increasingly common in enterprise environments. This campaign highlights that government and critical IT sectors remain high-value espionage targets, and that misconfigurations or overly permissive execution policies for native OS tools can be weaponized at scale.

What helps against this

How we list vendors

Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
For exampleWithSecure Elements XDR Huntress Managed EDR ESET PROTECT all options
Threat intelligence
Attack campaigns reach your sector, suppliers or software before your team hears about them.
For exampleGoogle Threat Intelligence CrowdStrike Falcon Adversary Intelligence Dataminr Agentic Threat Intelligence Platform all options
Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
For exampleDarktrace / EMAIL Proofpoint Core Email Protection Cloudflare Email Security all options

Indicators of Compromise

Extracted by AI from the linked source. Not reviewed by an editor. How this works

malware — QUICAgent
malware — COOLCLIENT
malware — Msagent.sys

Entities

Operation QUICSILVER (campaign)Mustang Panda (threat_actor)Seqrite Labs (vendor)ftp.exe (product)Cloudflare Workers (technology)