Reported by 3 outlets

Timeline

1. original reporting

   Operation QUICSILVER: China-Nexus Actor Targets Myanmar Diplomats via VHD-Delivered Go Backdoor

   malware.news · 57d ago · August 17th, 2026

   Contents Introduction Key Targets Industries Affected Geographical focus Infection Chain Campaign Timeline Initial Findings Looking into the Decoy Document Technical Analysis Stage 1 – LNK-Based Initial Access Stage 2 – Split Payload Reconstruction via ftp Script Stage 3 – QUICAgent Implant – Go-Based Backdoor Infrastructure & Attribution Conclusion SEQRITE Protection Indicators of Compromise (IOCs) MITRE ATT&CK Mapping Introduction Seqrite APT Team has been tracking threat activity across the globe, with a focus on campaigns targeting different industries and regions. During our recent research, we found a campaign targeting Myanmar that uses a Burmese-language graduation ceremony invitation from Myanmar’s Information Technology and Cyber Security Department as lure. The threat actor delivers the malware through a Virtual Hard Disk (VHD) file. While analyzing the VHD, we discovered several interesting artifacts. we also recovered files from the Recycle Bin that appear to have been unintentionally left behind by the threat actor. These overlooked files provided valuable context that helped us better understand the campaign’s attribution. In this blog, we will walk through the complete infection chain,

2. update from cyberpress.org

   China-Nexus Hackers Target Myanmar Diplomats With Government-Themed QUICAgent Malware Attacks

   cyberpress.org · 55d ago · August 19th, 2026

   A China-nexus threat actor has launched a targeted malware campaign against Myanmar government and diplomatic personnel using fake government invitations and virtual hard disk (VHD) files. Seqrite researchers named the activity Operation QUICSILVER and identified a custom Golang backdoor called QUICAgent. The campaign uses Burmese-language decoy documents impersonating Myanmar’s Information Technology and Cyber Security Department under the Ministry of Transport and Communications. One lure poses as an invitation to a graduation ceremony for government training programs, complete with an official-looking ministry seal. Recovered deleted files also suggest the attackers may be interested in diplomatic matters involving ASEAN, BIMSTEC, UN meetings, Malaysia, China, and Myanmar’s foreign affairs. China-Linked QUICAgent Targets Diplomats The attack begins with a file called TrainingAnnouncement.jpg , which is not a real image. It is a VHD file disguised with a JPG extension. When mounted, the VHD shows victims what appears to be a PDF named TrainingAnnouncement.pdf . However, the file is actually a malicious Windows shortcut, TrainingAnnouncement.pdf.lnk . Because Windows commonly hides known file extensions, victims may only see a PDF icon and believe the file is safe. China-Linked QUICAgent Targets Diplomats (Source: seqrite) When opened, the LNK file launches the legitimate Microsoft-signe

3. update from gbhackers.com

   China-Nexus Hackers Target Myanmar Diplomats With QUICAgent Go Backdoor via Malicious VHD Files

   gbhackers.com · 55d ago · August 19th, 2026

   The campaign relies on highly targeted social engineering. […] The post China-Nexus Hackers Target Myanmar Diplomats With QUICAgent Go Backdoor via Malicious VHD Files appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .