[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f20WwzTnt8_CoVz6f0IGolRbsmimuQLx2ndE3oIdp5Lc":3},{"article":4,"iocs":50,"watch_terms":60,"solutions":61,"lesson":150},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"0f9b1e45-fc5f-4991-9e3f-c9d52d082b94","Operation QUICSILVER Targets Myanmar Government and IT with QUICAgent Backdoor","operation-quicsilver-targets-myanmar-government-and-it-with-quicagent-backdoor-647d7c","Cybersecurity researchers have flagged a cyber espionage campaign targeting Myanmar that uses graduation ceremony invitation lures to deliver a Go backdoor called QUICAgent. The campaign, codenamed Operation QUICSILVER, has been found to target government and information technology sectors, per Seqrite Labs. The activity is assessed to be the work of a China-nexus threat actor with moderate","A cyber espionage campaign named Operation QUICSILVER has been targeting Myanmar's government and IT sectors, utilizing a Go-based backdoor called QUICAgent. The campaign, observed since April 2026, employs sophisticated multi-stage infection chains, including VHD files and abusing legitimate Windows binaries like ftp.exe, to deploy the malware. Researchers assess it to be the work of a China-nexus threat actor.","Operation QUICSILVER targets Myanmar with QUICAgent backdoor, linked to China-nexus actor.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F08\u002Foperation-quicsilver-targets-myanmar.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEhAU29lFKKhJ4-37mroz3wn9p8YejZSqMG70AcTu4Z_FLB6hhof-kGO8-6KOfJcE5TXPvrziWpqDpLu_Mi64u8ilPMtdicwexovYdtmVQhhFOTlAeEamKEccbGQf4Y15ufNQRggwtyzLJy32qocItBHu4FX7FLYDYbnjBXuYMtflnNB4ttrzIdynMPcquxs\u002Fs1600\u002Fsilver.jpg","2026-08-24T11:51:36+00:00","2026-08-24T14:00:05.602407+00:00",8,[17,20,23,26,29],{"name":18,"type":19},"Operation QUICSILVER","campaign",{"name":21,"type":22},"Mustang Panda","threat_actor",{"name":24,"type":25},"Seqrite Labs","vendor",{"name":27,"type":28},"ftp.exe","product",{"name":30,"type":31},"Cloudflare Workers","technology","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":32,"icon":34,"name":35,"slug":36},null,"Nation-state","nation-state",[38,40,45],{"category":39},{"id":32,"icon":34,"name":35,"slug":36},{"category":41},{"id":42,"icon":34,"name":43,"slug":44},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[51,54,57],{"type":44,"value":52,"context":53},"QUICAgent","Custom Go-based backdoor implant",{"type":44,"value":55,"context":56},"COOLCLIENT","Updated backdoor used by Mustang Panda",{"type":44,"value":58,"context":59},"Msagent.sys","Signed kernel-mode driver associated with COOLCLIENT",[24,27],{"controls":62,"vendors":149},[63,92,120],{"slug":64,"name":65,"problem":66,"products":67},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[68,76,84],{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"slug":49,"name":93,"problem":94,"products":95},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[96,104,112],{"vendor_slug":97,"vendor_name":98,"vendor_logo":99,"product_slug":100,"product_name":101,"url":102,"description":103},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",{"slug":121,"name":122,"problem":123,"products":124},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[125,133,141],{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-email","Darktrace \u002F EMAIL","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Femail","Email security that flags messages deviating from normal communication patterns.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","core-email-protection","Proofpoint Core Email Protection","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Femail-protection","Email filtering for phishing, malware and business email compromise.",{"vendor_slug":142,"vendor_name":143,"vendor_logo":144,"product_slug":145,"product_name":146,"url":147,"description":148},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-email-security","Cloudflare Email Security","https:\u002F\u002Fwww.cloudflare.com\u002Fsase\u002Fproducts\u002Femail-security\u002F","Email filtering for phishing and business email compromise.",[],{"slug":151,"title":152,"body":153,"framework_refs":154,"framework_notes":168},"quicagent-backdoor-exploits-living-off-the-land-techniques-in-myanmar-espionage-campaign","QUICAgent Backdoor Exploits Living-off-the-Land Techniques in Myanmar Espionage Campaign","Operation QUICSILVER demonstrates how sophisticated threat actors leverage legitimate Windows binaries (such as ftp.exe) and unconventional delivery mechanisms (VHD files) to evade traditional defenses — a technique known as Living-off-the-Land (LotL). The abuse of trusted system tools makes detection significantly harder, as security controls often whitelist these binaries by default. The use of the QUIC protocol for command-and-control further complicates network-level detection since QUIC traffic is encrypted and increasingly common in enterprise environments. This campaign highlights that government and critical IT sectors remain high-value espionage targets, and that misconfigurations or overly permissive execution policies for native OS tools can be weaponized at scale.",[155,156,157,158,159,160,161,162,163,164,165,166,167],"MITRE ATT&CK T1218 – System Binary Proxy Execution","MITRE ATT&CK T1071.001 – Application Layer Protocol: Web Protocols","MITRE ATT&CK T1553 – Subvert Trust Controls","CIS Control 2 – Inventory and Control of Software Assets","CIS Control 4 – Secure Configuration of Enterprise Assets and Software","CIS Control 9 – Email and Web Browser Protections","CIS Control 13 – Network Monitoring and Defense","NIST SP 800-53 CM-7 – Least Functionality","NIST SP 800-53 SI-4 – System Monitoring","NIST SP 800-53 SC-7 – Boundary Protection","NIST SP 800-171 3.1.2 – Limit system access to types of transactions and functions authorized users are permitted to execute","NIST Cybersecurity Framework DE.CM-1 – Network Monitoring","NIST Cybersecurity Framework PR.AC-5 – Network Integrity Protection",{}]