Operation QUICSILVER Targets Myanmar Government and IT with QUICAgent Backdoor

Researchers attributed a targeted cyber espionage campaign (Operation QUICSILVER) to a China-nexus actor targeting Myanmar government and IT sectors; attackers used VHD/LNK lures and LOLBAS abuse of ftp.exe to reconstruct and deploy a Go-based backdoor named QUICAgent that communicates to C2 via QUIC/UDP (notably retrieving the C2 via Cloudflare Workers and using 104.64.211.22:443), while related reporting highlights Mustang Panda’s use of COOLCLIENT with a signed kernel-mode driver to improve stealth.