Seqrite tracked Operation QUICSILVER, a China-nexus campaign targeting Myanmar government personnel with a Burmese-language lure delivered in a disguised VHD file. The operation uses a malicious LNK, ftp.exe, split-payload reconstruction, and a Go backdoor named QUICAgent that communicates via Cloudflare Workers and QUIC while using RC4 encryption. #QUICAgent #OperationQUICSILVER #CloudflareWorkers #ftp.exe
Keypoints
- The campaign targeted Myanmar government personnel using a formal Burmese invitation impersonating Myanmar’s Information Technology and Cyber Security Department.
- The initial lure was delivered as a VHD file disguised as a JPEG image, with a decoy document shown to victims.
- A malicious LNK file launched ftp.exe with a local script to begin the infection chain.
- The script combined two disguised files, header.doc and body.doc, to reconstruct and launch Windowsupdate.exe.
- Windowsupdate.exe is a Go-based backdoor named QUICAgent that uses sandbox evasion, RC4-encrypted C2 traffic, and QUIC over UDP/443.
- The malware retrieved its real C2 through Cloudflare Workers and used persistent startup-folder shortcut creation on the victim machine.
- Seqrite assessed the activity as China-nexus with moderate confidence and linked it to Operation QUICSILVER.
MITRE Techniques
- [T1566.001 ] Phishing: Spearphishing Attachment – The lure was delivered as a malicious attachment disguised as a legitimate document or archive (‘uses a Burmese-language graduation ceremony invitation as lure’).
- [T1204.002 ] User Execution: Malicious File – The victim must open the disguised VHD/LNK file to trigger the infection (‘once the victim opens the file’).
- [T1218 ] System Binary Proxy Execution: ftp.exe – The LNK launches the legitimate Microsoft-signed ftp.exe to execute attacker-stored commands (‘abuses its -s: option to execute commands stored in a local script file’).
- [T1059.001 ] Command and Scripting Interpreter – A local script file is used to control the infection steps and launch commands (‘contains the commands that execute the next stage of the infection’).
- [T1027.009 ] Obfuscated Files or Information – The payload is split and reconstructed from separate parts to hide its true nature (‘combining two parts of the same executable to reconstruct the payload’).
- [T1036.008 ] Masquerading: Masquerade File Type – Files and icons were used to appear as PDFs or JPEGs while actually being VHD/LNK or executable content (‘using a PDF icon to appear legitimate’).
- [T1070.004 ] Indicator Removal: File Deletion – Deleted files were found in the Recycle Bin, and the malware left or removed artifacts during execution (‘files inside the Recycle Bin that appear to have been accidentally left behind’).
- [T1547.001 ] Boot or Logon Autostart Execution – Persistence was achieved by placing a shortcut in the Startup folder (‘creates a shortcut in the current user’s Startup folder’).
- [T1082 ] System Information Discovery – The implant collected host information such as DNS hostname and username (‘collects basic information about the infected system’).
- [T1083 ] File and Directory Discovery – The script searched hidden directories and files before reconstructing the payload (‘searches for two document files, header.doc and body.doc, stored inside the hidden _rels directory’).
- [T1102.001 ] Web Service: Dead Drop Resolver – Cloudflare Workers were used to fetch the real C2 hostname dynamically (‘the malware uses two Cloudflare Workers URLs to dynamically retrieve the backend server address’).
- [T1041 ] Exfiltration Over C2 Channel – Victim data was sent in RC4-encrypted JSON within beacon traffic to the C2 server (‘sends an HTTP/3 POST request containing RC4-encrypted JSON’).
Indicators of Compromise
- [SHA-256 ] Malicious sample and payload hashes – TrainingAnnouncement.jpg: 26f735cbbb1257be94e6d01656a35bf66a8ae9c34868548d69ec5cb588f9f916, Windowsupdate.exe: cd147efe37003399e174951927e5fe727a4481756b116f0204a14a64cc62b059, and 2 more hashes
- [File names ] Lure, script, and payload filenames – TrainingAnnouncement.pdf.lnk, header.doc, body.doc, and 2 more items
- [Domains ] C2 and infrastructure domains – register[.]mediumser[.]com, appupdate[.]0cmds20cj2cdf8[.]workers.dev, and other 1 item
- [IP addresses ] Resolved C2 infrastructure – 104[.]64[.]211[.]22, 38[.]60[.]244[.]141
- [URLs ] Cloudflare Workers endpoints used for C2 resolution – hxxps://appupdate.0cmds20cj2cdf8.workers.dev/A3cmf0q9ASCion, hxxps://regupdate.eamakfu49dc28wa.workers.dev/vere0zme82cadre
- [Certificates / strings ] Embedded TLS identity and crypto material – certificate name “RAT CA” under organization “RAT System”, RC4 key: MySecretEncryptionKey2025!@#$%
- [Detection names ] Vendor detections associated with the samples – Vhd.Trojan.Downloader.51019.GC, Lnk.Trojan.Downloader.51020.GC, Trojan.Dedok