Researchers at Seqrite Labs have documented a cyber espionage campaign, dubbed Operation QUICSILVER, running since April 2026 against Myanmar’s government and technology sector. The threat actor — assessed with moderate confidence to be China-linked — is using social engineering lures crafted to look like official government communications, including invitations to graduation ceremonies written in Burmese. Opening the decoy launches a chain that ultimately installs QUICAgent, a custom backdoor written in Go.
What makes QUICAgent notable is its choice of transport: instead of HTTP or raw TCP, it communicates over QUIC (the UDP-based protocol that underpins HTTP/3), on port 443. This lets it blend into normal web traffic and makes it harder to block without also disrupting legitimate HTTPS connections. The implant retrieves its command-and-control address dynamically through Cloudflare Workers domains — helping it survive infrastructure takedowns — and beacons home every five seconds. To defeat sandbox analysis, the malware also burns time with 1,000 SHA-256 hash iterations and adds random delays between 100 and 600 milliseconds before executing. Once installed via a Windows Startup folder shortcut, it supports command execution, file transfer, and directory browsing. Confirmed targets include Myanmar’s Information Technology and Cyber Security Department and several IT sector organizations.