QUICSILVER campaign strings decoy PDFs to drop Go backdoor

The line between a routine email attachment and a network intrusion can be as thin as a PDF icon. A new espionage campaign, dubbed Operation QUICSILVER by researchers at Seqrite Labs, exploits that gap by disguising malicious files as graduation ceremony invitations, targeting Myanmar's government and IT sectors. The campaign, first observed in April 2026, marks a notable evolution in the use of Virtual Hard Disk (VHD) files and living-off-the-land binaries to deliver a Go-based backdoor called QUICAgent.

Seqrite Labs, the cybersecurity arm of the Indian company, has assessed with moderate confidence that the activity is the work of a China-nexus threat actor. The infection chain begins with a lure that leverages social engineering—a fabricated holiday calendar and a decoy PDF that mimics an official invitation from Myanmar's Information Technology and Cyber Security Department (ITCSD), which falls under the Ministry of Transport and Communications. The campaign's multi-stage approach demonstrates a careful attention to evasion, combining legitimate Microsoft-signed binaries with hidden file reconstructions to avoid detection.

From Holiday Calendar to Hidden Payload

The first observed attack in April 2026 delivered a file named "HolidayNotice.pdf.exe" alongside a lure that was a fabricated Belgian–Myanmar public holiday calendar. This initial delivery method was followed by two more artifacts in June and July 2026, each of which shifted to using a VHD file to trigger the infection chain. The shift to VHDs is notable because these files are often overlooked by traditional email scanners, allowing the malicious payload to reach the victim's system more easily.

Inside the VHD file is a Windows Shortcut (LNK) file that masquerades as a PDF document. When the victim opens it, the system displays a decoy PDF—an official-looking graduation ceremony invitation written in Burmese and attributed to the ITCSD. The convincing document serves as a distraction while the LNK file silently executes a legitimate Microsoft-signed binary called "ftp.exe." By abusing the "-s" option of ftp.exe, the shortcut runs commands stored in a local script file, a technique that leverages living-off-the-land binaries (LOLBAS) to blend in with normal system activity.

Reconstructing the Next Stage with copy /b

Researchers Priya Patel and Kartik Jivani of Seqrite Labs detailed the next step in the attack. "While the decoy is presented on the victim's screen, the script searches for two document files, header.doc and body.doc, stored inside the hidden _rels directory," they said. "It then combines these two files using the native Windows copy /b command to reconstruct the next-stage payload."

This technique of reassembling a payload from fragments is a clever way to bypass security tools that might flag a single suspicious file. The hidden directory and the use of a native Windows command help the attacker avoid detection until the payload is fully formed. The reconstructed payload is a Golang-based implant named QUICAgent, which is designed to connect to a command-and-control (C2) server.

Evading Sandboxes with Random Delays

QUICAgent incorporates sandbox evasion techniques to avoid running in automated analysis environments. The implant introduces a random delay of 100-600 milliseconds and executes 1,000 iterations of SHA-256 hashing operations, which exhausts the time limits of automated sandbox execution. This makes it harder for researchers to analyze the malware's behavior in a controlled setting.

Once the implant runs, it retrieves the backend C2 server address dynamically. By sending an HTTP GET request to two Cloudflare Workers domains, the malware obtains the address "104.64.211[.]22." It then suffixes port 443 to the domain to construct the final destination. The malware uses QUIC over UDP port 443 to communicate with the C2 server, a protocol choice that may help it evade detection by network monitoring tools that typically focus on TCP traffic.

Beaconing and Persistence Mechanisms

The initial beacon sent to the C2 server includes basic information about the compromised host. The beacon is transmitted every five seconds, and each infected machine is assigned a unique X-Agent-ID to identify the victim. This beaconing behavior allows the attackers to maintain a steady connection and receive commands in real time.

QUICAgent is described as fairly basic, supporting only five commands: execute commands, transfer files, browse directories, and modify the beacon interval. Despite its simplicity, the backdoor is effective for espionage purposes, allowing attackers to run arbitrary commands on the victim's system and exfiltrate data. Persistence is achieved by setting up an LNK file in the current user's Windows Startup folder, ensuring that the backdoor is automatically executed the next time the user logs in.

Abusing LIVING-OFF-THE-LAND Binaries

The campaign’s use of ftp.exe as a LOLBAS is a key aspect of its stealth. By using a legitimate, Microsoft-signed binary, the attackers can execute their commands without raising immediate red flags. The "-s" option of ftp.exe allows it to run commands from a file, which is exactly what the LNK file leverages. This approach is a common tactic in modern attacks, as it helps avoid detection by security solutions that may not scrutinize legitimate system tools closely.

The multi-stage infection chain also involves the reconstruction of the payload from two fake document files, header.doc and body.doc. This method not only hides the payload in plain sight but also complicates file-based detection. Seqrite Labs noted that the campaign uses this technique to deliver a custom Go-based backdoor, which they have named QUICAgent. The company highlighted the chain's complexity in its report, emphasizing the careful design behind each step.

Connected to a Broader Trend: COOLCLIENT's Kernel Driver

The disclosure of Operation QUICSILVER coincides with reports of an updated version of the COOLCLIENT backdoor, linked to the China-backed Mustang Panda actor. COOLCLIENT now includes a signed kernel-mode driver called "Msagent.sys," which enhances the malware's stealth by hiding its process and protecting related files and registry entries. Kaspersky detected this updated variant in intrusions across Myanmar, Mongolia, Pakistan, and Russia, suggesting a broader regional campaign.

The newer COOLCLIENT variant uses a similar kernel-mode enhancement to that identified in TONESHELL, another backdoor attributed to Mustang Panda. COOLCLIENT is assessed to be deployed via PlugX using DLL sideloading, a technique extensively used by the hacking group. The backdoor supports a wide range of capabilities, including keylogging, clipboard theft, credential harvesting, file management, system reconnaissance, and plugin-based extensions. It was first detected in the wild in 2022.

Kaspersky's analysis of the updated variant highlighted the driver's role in enhancing stealth. "The driver enhances the malware's stealth by hiding the COOLCLIENT process, protecting related files and registry entries, and preventing them from being inspected or modified," Kaspersky said, adding that it detected the variant and its accompanying driver in intrusions across Myanmar, Mongolia, Pakistan, and Russia. "While the overall execution flow remains consistent with previously documented COOLCLIENT variants, this sample introduces a previously undocumented kernel-mode driver that significantly expands the malware's stealth capabilities."

Data Points from the Campaign

• First observed in April 2026 with a file named "HolidayNotice.pdf.exe"
• Two subsequent artifacts detected in June and July 2026 using VHD files
• QUICAgent uses a random delay of 100-600 milliseconds and 1,000 SHA-256 iterations for sandbox evasion
• C2 server address: 104.64.211[.]22, port 443 via QUIC over UDP
• Beacon transmitted every five seconds with a unique X-Agent-ID
• COOLCLIENT first detected in 2022, updated variant found in Myanmar, Mongolia, Pakistan, and Russia

What This Means for Defenders

The QUICSILVER campaign underscores the importance of examining VHD files and LNK attachments with a skeptical eye, even when they appear to come from trusted sources like a government department. The use of legitimate binaries and hidden file reconstruction makes signature-based detection less effective, pushing defenders toward behavior-based monitoring and user education. The decoy PDFs are crafted in Burmese, a detail that suggests the attackers have tailored their lures to the target audience, increasing the likelihood of a click.

For organizations in Myanmar's government and IT sectors, as well as those operating in the region, this campaign signals a persistent threat actor that is willing to evolve its techniques. The connection to COOLCLIENT and the kernel-driver enhancements indicates that threat actors are continually refining their tools to avoid detection. Security teams should review their endpoint detection and response capabilities, paying close attention to unusual uses of ftp.exe and other system utilities, and consider implementing stricter controls on VHD files and LNK shortcuts from external sources.

The use of Cloudflare Workers domains to fetch the C2 address adds another layer of evasion, as these domains may appear legitimate and are harder to block than direct IP addresses. Defenders should monitor network traffic for QUIC protocol activity on port 443, especially if it is not commonly used in their environment. By understanding the mechanics of campaigns like QUICSILVER, security teams can better prepare for the next evolution of these threats.