SecurityNot yet confirmed elsewhere1 publisher2 min readPublished Updated
QUICSILVER runs its C2 over QUIC, and most port-443 inspection is scoped to TCP
Seqrite's Myanmar campaign hides a Go backdoor's traffic in UDP 443, with a single HTTP request in the whole chain. The monitoring gap travels regardless of your threat model.
The Watch · Security desk
What happened
- Seqrite Labs attributes Operation QUICSILVER, aimed at Myanmar government and IT targets, to a China-nexus actor with moderate confidence.
- The first sighting, in April 2026, paired a HolidayNotice.pdf.exe file with a fabricated Belgian-Myanmar public holiday calendar.
- Later samples show a decoy graduation invitation in Burmese, branded to Myanmar's ITCSD under the Ministry of Transport and Communications.
- Execution runs through Microsoft-signed ftp.exe, whose -s option is abused to run commands from a local script file.
- The resulting Go backdoor, QUICAgent, talks to its controller using QUIC over UDP port 443.
Why it matters
- constraint Inspection built on the assumption that 443 means TCP and TLS cannot cover this channel, so money already spent on interception buys no visibility into it.
- cost The dependable signal is volumetric, which moves the bill to UDP flow record retention and query capacity rather than the TLS proxy most shops already run.
- decision The lure is Myanmar-specific but the loader is portable, forcing a call on whether to detect signed-binary script execution even where the region is irrelevant.
- exposure The reachable takedown surface belongs to Cloudflare's Workers namespace rather than the operator, and the resolved address is replaceable, so IP blocklists decay faster than the technique.
There is exactly one HTTP request in the documented chain: a GET to two Cloudflare Workers domains that hands back the backend address, reported as 104.64.211[.]22 with port 443 appended [9]. That request is the part a proxy log can hold. Everything after it moves on a transport that TLS interception and TCP-443 handshake fingerprinting are not scoped to observe [17].
The implant is not quiet about it. Beacons leave every five seconds, each stamped with a per-host X-Agent-ID [10], which works out to 720 an hour and 17,280 a day from a single machine [18]. That regularity is the durable detection opportunity here, and it sits in flow records rather than content inspection, which makes it contingent on whether UDP flows are retained at all.
The host side avoids anything resembling a download. The June and July samples arrive inside a VHD [4]. The next stage is rebuilt from header.doc and body.doc in a hidden _rels directory using copy /b, according to Seqrite researchers Priya Patel and Kartik Jivani [7], so neither file on disk is the backdoor and the executable exists only after reassembly [19]. Persistence is a shortcut dropped in the user's Startup folder [11].
QUICAgent itself is thin: five commands covering shell execution, file transfer, directory browsing and changing the beacon interval [12]. Its anti-analysis is a random delay of 100 to 600 milliseconds plus 1,000 rounds of SHA-256 hashing, which Seqrite reads as an effort to exhaust sandbox execution limits [8]. The engineering that matters is not in the implant, it is in the choice of channel.
Attribution is moderate confidence [1], and the reporting supplied here is a single Hacker News write-up of Seqrite's research, so this rests on one vendor's telemetry until someone publishes overlapping indicators [16].
The same report carries Kaspersky's separate finding: Mustang Panda's updated COOLCLIENT, in the wild since 2022 [15], now shipping a signed kernel-mode driver called Msagent.sys that hides the process and shields its files and registry entries from inspection, sideloaded via PlugX [13], detected in intrusions across Myanmar, Mongolia, Pakistan and Russia [14]. Myanmar appears in both data sets [20]. Two China-nexus operations in the same country are buying stealth at different layers, one under the operating system's view and one under the network monitor's.
The transport decision cost the QUICSILVER operator a Go library. Closing the gap it exploits costs the defender either an egress policy on UDP 443 or QUIC-aware inspection, and the asymmetry is the reason it will keep working.
What to watch
- Whether a second vendor or a regional CERT publishes overlapping QUICSILVER indicators, which the reporting does not yet have.
- Whether QUICAgent or the same ftp.exe and copy /b loader appears against targets outside Myanmar.
- Whether the two Cloudflare Workers dead-drop domains are taken down, and where the operator moves the address lookup if they are.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence54
- Adoption32
- Hype gap+12
- Incentives62
- Confidence48
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Seqrite Labs assesses Operation QUICSILVER, a campaign targeting Myanmar government and information technology sectors, as the work of a China-nexus threat actor with moderate confidence.
ReportedSupportedSource: Seqrite Labs, via The Hacker News2 sources— create a free account to open themView cited source - [2]
The malware uses QUIC over UDP port 443 to communicate with the command-and-control server.
- [3]
The activity was first observed in April 2026, delivering a file named "HolidayNotice.pdf.exe" alongside a lure that was a fabricated Belgian-Myanmar public holiday calendar.
- [4]
Two subsequent artifacts, detected in June and July 2026, use a Virtual Hard Disk (VHD) file to activate the infection chain, with a Windows Shortcut (LNK) inside the VHD that mimics a PDF document.
- [5]
Opening the shortcut displays a decoy PDF: an official graduation ceremony invitation written in Burmese, purporting to come from the Information Technology and Cyber Security Department (ITCSD) under Myanmar's Ministry of Transport and Communications.
- [6]
While the decoy is displayed, the shortcut launches ftp.exe, a legitimate Microsoft-signed Windows binary, abusing its "-s" option to run commands stored in a local script file; Seqrite describes this as LOLBAS abuse.
- [7]
Seqrite researchers Priya Patel and Kartik Jivani said the script searches for two files, header.doc and body.doc, stored in the hidden _rels directory, and combines them using the native Windows copy /b command to reconstruct the next-stage payload.
- [8]
QUICAgent, a Golang-based implant, incorporates a random delay of 100-600 milliseconds and executes 1,000 iterations of SHA-256 hashing to exhaust automated sandbox execution time limits.
- [9]
The backend C2 address is retrieved dynamically by sending an HTTP GET request to two Cloudflare Workers domains; once obtained ("104.64.211[.]22"), the malware appends port 443 to construct the final destination.
- [10]
The initial beacon includes basic information about the compromised host, is transmitted every five seconds, and each infected machine is assigned a unique X-Agent-ID.
- [11]
Persistence is achieved by setting up an LNK file in the current user's Windows Startup folder so it runs at next logon.
- [12]
QUICAgent supports five commands, covering command execution, file transfer, directory browsing and modification of the beacon interval.
- [13]
Kaspersky reported that China-linked Mustang Panda is using an updated COOLCLIENT backdoor that deploys a previously undocumented signed kernel-mode driver, Msagent.sys, which hides the COOLCLIENT process and protects related files and registry entries from inspection or modification; the backdoor is assessed to be deployed via PlugX using DLL sideloading.
- [14]
Kaspersky said it detected the updated COOLCLIENT variant and its accompanying driver in intrusions across Myanmar, Mongolia, Pakistan and Russia.
- [15]
COOLCLIENT was first detected in the wild in 2022 and supports keylogging, clipboard theft, credential harvesting, file management, system reconnaissance and plugin-based extensions.
- [16]
The QUICSILVER findings in the reporting trace to one vendor's research, Seqrite Labs, relayed by a single publisher; the two supplied source blocks carry identical text from the same article.
- [17]
Because the C2 channel is QUIC over UDP port 443, controls scoped to TCP port 443 (TLS interception, proxy logging, TLS handshake fingerprinting) have no view of it; only the initial HTTP address lookup falls inside their scope.
- [18]
A five-second beacon interval produces 720 beacons per hour and 17,280 per day from each infected host.
- [19]
Neither header.doc nor body.doc is a complete payload as it sits on disk; the executable only exists after on-host reassembly by copy /b.
- [20]
Myanmar appears both as the target of QUICSILVER and in Kaspersky's COOLCLIENT intrusion set, making it common ground between two separately reported China-nexus operations.
Sources
1 independent publisher whose own reporting we read for this story.
- thehackernews.comOperation QUICSILVER Targets Myanmar Government and IT with QUICAgent Backdoor
2 articles · August 24, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
Entities
- GoFollow
- QUICFollow
- ToneShellFollow
- PlugXFollow
- Kartik JivaniFollow
- Information Technology and Cyber Security Department (Myanmar)Follow
- Msagent.sysFollow
- Seqrite LabsFollow
- QUICAgentFollow
- Mustang PandaFollow
- The Hacker NewsFollow
- KasperskyFollow
- Priya PatelFollow
- Operation QUICSILVERFollow
- Cloudflare WorkersFollow
- CoolClientFollow