Seqrite, the enterprise security arm of Quick Heal Technologies Limited, a global provider of cybersecurity solutions, today disclosed Operation QUICSILVER, a cyber-espionage campaign assessed with moderate confidence to be China-nexus, targeting government and information-technology personnel in Myanmar through malicious Virtual Hard Disk (VHD) files disguised as image and document attachments.
Researchers at Seqrite Labs, India’s largest malware analysis facility, identified the campaign while tracking global threat activity and traced it to at least three related intrusion sets active between April and July 2026. The earliest sample, distributed as a fabricated Belgian-Myanmar public holiday calendar, suggests the threat actor also sought to target foreign personnel, including embassy and NGO staff, operating in Myanmar. Two subsequent VHD-based samples, disguised as a training announcement image and an ACMECS-themed document, shared the same infection chain, payload and command-and-control infrastructure.
The primary lure used in the campaign is a formal, Burmese-language graduation ceremony invitation impersonating Myanmar’s Information Technology and Cyber Security Department under the Ministry of Transport and Communications. The decoy references two genuine-sounding training programs and includes an official ministry seal, lending the file significant credibility. The malicious file itself, however, is not a JPEG image as its name suggests; it is a VHD container that, once mounted, presents a Windows shortcut disguised with a PDF icon.
Opening the disguised shortcut triggers a legitimate Microsoft-signed Windows binary, abused to execute a hidden local script. That script displays the decoy document to distract the victim while quietly combining two disguised files using native Windows commands to reconstruct the final payload, which is then launched directly from the user’s local application-data folder. The reconstructed payload is a custom backdoor that Seqrite researchers have named QUICAgent. Before contacting its operators, the implant performs sandbox-evasion routines, including randomised delays and repeated cryptographic hashing designed to exhaust automated analysis environments. It then resolves its live command-and-control address dynamically through two Cloudflare Workers endpoints, rather than relying on a hardcoded server, making takedown and detection considerably more difficult.
Once resolved, QUICAgent communicates with its C2 infrastructure over QUIC, encrypting all traffic with RC4 and validating the server’s certificate against a hardcoded, self-signed certificate authority embedded in the binary. The implant beacons every five seconds, collects the victim’s hostname and logged-in username, and supports five operator commands covering remote shell access, file upload and download, directory listing and beacon-interval control. Persistence is established through a shortcut placed in the user’s Startup folder, ensuring the backdoor relaunches automatically at every login.
During investigation, Seqrite researchers also recovered several deleted documents left behind in the VHD’s Recycle Bin, apparently by accident. These included sensitive-looking material referencing BIMSTEC and ASEAN diplomatic dialogue, a Malaysian foreign-policy assessment on Myanmar, and documents impersonating official Myanmar Ministry of Foreign Affairs communications. While not directly delivered to victims, these artefacts offer additional insight into the breadth of targets and themes the threat actor may be pursuing across the region. Combined with the government-themed lures, regional victimology and observed tactics, techniques and procedures, Operation QUICSILVER appears to be a China-nexus activity.
The campaign illustrates a broader pattern Seqrite continues to track across the region: threat actors disguising executable payloads as ordinary image or document files, abusing legitimate signed Windows utilities to avoid triggering security alerts, and relying on modern cloud infrastructure such as Cloudflare Workers to make command-and-control channels more resilient and harder to block. Seqrite has released detection signatures for the VHD dropper, LNK loader and backdoor components associated with this campaign and continues to monitor the threat actor’s infrastructure for further activity.
Operation QUICSILVER shows how attackers are combining old tricks with new infrastructure. Seqrite urges government agencies and organisations across South and Southeast Asia to treat unexpected file types – especially disk images posing as documents or photos – with the same scrutiny as executables, and pair that vigilance with layered detection capable of spotting encrypted, dynamically resolved command-and-control traffic. Layering existing security infrastructure with Seqrite Zero Trust Network Access (ZTNA) and Seqrite Digital Risk Protection Services (DRPS) can help government entities prevent domain impersonation, typosquatting, and executive profile clones through dark web exposure monitoring and automated takedowns.
