Operation QUICSILVER Drops a Go Backdoor on Myanmar Government

Three Waves Since April 2026, One Infection Chain

Operation QUICSILVER is an espionage campaign that has run against Myanmar in three waves since April 2026. All three waves work the same way. The attacker hides a backdoor inside a virtual disk image, disguises it using a lure copied from Myanmar government correspondence, and relies on the victim to open it. The first wave used a fake Belgian and Myanmar public holiday calendar, which suggests the attacker was interested in Belgian embassy and NGO staff working in the country. The two later waves, seen in June and July 2026, used disk images instead. Both delivered the same payload, used the same infection chain, and contacted the same servers. The payload is QUICAgent, a custom backdoor written in Go. The attacker has not been named, but the activity is assessed as China-nexus with moderate confidence.

A Fake Graduation Invitation Hides a Windows Shortcut

The victim receives a file that looks like an image. It is actually a virtual disk, and its file size is much larger than a real image of that type would be. When the disk is opened, it appears to contain one document. That document is really a Windows shortcut using a document icon. Windows hides familiar file extensions by default, so the victim never sees what the file really is. Opening it displays a graduation ceremony invitation written in Burmese. The invitation impersonates the Information Technology and Cyber Security Department under the Ministry of Transport and Communications, and includes the ministry seal as a watermark and a real-sounding venue in Naypyidaw.

A Signed Utility Reassembles a Payload Split in Two

While the invitation is on screen, the shortcut runs a legitimate Microsoft-signed Windows utility and uses it to execute a hidden script. The script finds two files that look like documents and joins them into a working program using a built-in Windows command. It saves the program in the user's local application data folder and runs it. Because the payload is split in two, neither half can run on its own, so neither half looks harmful when examined separately. Once the backdoor starts, it wastes time on purpose. It waits a short random interval and performs a thousand hashing operations, which is enough to outlast the time limit most automated analysis sandboxes allow. It then creates a shortcut to itself in the user's Startup folder, so it runs again every time the user logs in. It does not modify the registry.

Minimal Automatic Collection, Manual Operator Control

The backdoor does very little on the victim network. It collects only what the first check-in needs: the machine name and the logged-in username. Any further activity would have to be carried out manually by the operator, who can run commands, upload and download files, list directories, and change how often the backdoor checks in. The backdoor finds its server in two steps. First it contacts two cloud-hosted endpoints, and each one replies with the real server name in plain text. The backdoor then adds the connection details and connects to that server. In the case observed, the endpoints returned a subdomain that pointed to a US-hosted address, and the backdoor connected to it using QUIC. QUIC is important because it runs over UDP, which means it can pass through security tools built to inspect standard TCP-based encrypted traffic.

Self-Signed Certificate Pinning and Numeric Command IDs

The traffic is also encrypted using a key stored inside the backdoor itself. Instead of trusting the certificates installed on the operating system, the backdoor checks the server against a self-signed certificate authority built into its own code. It checks in every five seconds by default, and the server assigns each infected machine its own identifier. The command names are stored as numbers rather than readable text, so they can only be recovered by reverse engineering the file. Stolen files are sent out over the same encrypted connection used to receive commands, so there is no separate exfiltration channel.