Operation QUICSILVER Uses LNK Files and Fake Images Against Myanmar Government Diplomats

EXECUTIVE SUMMARY:

Operation QUICSILVER is a targeted cyber campaign aimed at Myanmar government personnel using government-themed documents as lures. The attackers distribute malicious Virtual Hard Disk (VHD) files disguised as legitimate image files, containing a Burmese-language graduation ceremony invitation designed to impersonate a government department. The campaign ultimately deploys a custom Go-based backdoor, tracked as QUICAgent, enabling attackers to maintain access to compromised systems and conduct further malicious activities. The targeting and recovered artifacts indicate a focus on government and information technology entities in Myanmar, with the activity assessed as China-nexus with moderate confidence.[emaillocker id="1283"]

The attack chain begins with a malicious VHD file delivered to targeted victims, which contains files designed to initiate execution on the compromised Windows system. The VHD-based delivery approach can help the threat actor evade conventional security controls by presenting the malicious payload as a mounted disk image. Once executed, the malware deploys a Go-based backdoor that provides remote access and enables the attacker to interact with the infected system. The backdoor can support capabilities such as collecting system information, executing commands, managing files, and communicating with attacker-controlled infrastructure. The use of a custom Go-based payload together with VHD delivery adds multiple layers to the infection chain and can make detection and analysis more difficult. The observed targeting patterns, infrastructure characteristics, and technical overlaps support the assessment that the activity is associated with a China-nexus espionage operation.

Operation QUICSILVER demonstrates a multi-stage intrusion chain that combines social engineering, VHD-based delivery, masquerading, legitimate Windows utilities, payload reconstruction, and a custom backdoor to evade detection and maintain access. The use of government-themed lures and infrastructure associated with diplomatic and regional affairs indicates a strong espionage focus. Based on the observed victimology, technical overlaps, infrastructure, and operational artifacts, the activity is assessed with moderate confidence as China-nexus. Organizations handling government, diplomatic, and sensitive regional information should strengthen monitoring of VHD and LNK files, restrict abuse of legitimate system utilities, and detect unusual QUIC-based outbound communications and Startup-folder persistence.

THREAT PROFILE:

MBC MAPPING:

REFERENCES:

The following reports contain further technical details:

https://cybersecuritynews.com/china-nexus-hackers/

https://www.seqrite.com/blog/operation-quicsilver-china-nexus-actor-targets-myanmar-diplomats-via-vhd-delivered-go-backdoor/