Malware

QUICAgent

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

12 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566.001Spearphishing AttachmentEvidence2

MITRE ATT&CK Mapping Tactic Technique ID Technique Name Initial Access T1566.001 Phishing: Spearphishing Attachment

Execution

2 techniques

T1059.001PowerShellEvidence2

T1204.002Malicious FileEvidence2

MITRE ATT&CK Mapping Tactic Technique ID Technique Name Initial Access T1566.001 Phishing: Spearphishing Attachment Execution T1204.002 User Execution: Malicious File

Persistence

1 technique

T1547.001Registry Run Keys / Startup FolderEvidence2

To maintain persistence on the infected system, the backdoor creates a shortcut in the current user’s Startup folder.

Privilege Escalation

1 technique

T1547.001Registry Run Keys / Startup FolderEvidence2

To maintain persistence on the infected system, the backdoor creates a shortcut in the current user’s Startup folder.

Stealth

4 techniques

T1027.009Embedded PayloadsEvidence2

MITRE ATT&CK Mapping Tactic Technique ID Technique Name Initial Access T1566.001 Phishing: Spearphishing Attachment Execution T1204.002 User Execution: Malicious File T1059.001 Command and Scripting Interpreter T1218 System Binary Proxy Execution: ftp.exe Defense Evasion T1027.009 Obfuscated Files or Information

T1036.008Masquerade File TypeEvidence2

Although it looked like a PDF document, it was actually a Windows shortcut (LNK) file using a PDF icon to appear legitimate.

T1070.004File DeletionEvidence1

T1218System Binary Proxy ExecutionEvidence2

Once the victim opens the file, the LNK launches ftp.exe, a legitimate Microsoft-signed Windows binary. The threat actor then abuses its -s: option to execute commands stored in a local script file.

Discovery

2 techniques

T1082System Information DiscoveryEvidence2

Before communicating with the C2 server, the backdoor QUICAgent collects basic information about the infected system... The collected data consists of the victim’s DNS hostname... the currently logged-in username

T1083File and Directory DiscoveryEvidence2

The implant supports five commands that allow the operator to execute commands, transfer files, browse directories, and control the beacon interval.

Command and Control

1 technique

T1102.001Dead Drop ResolverEvidence2

the malware uses two Cloudflare Workers URLs to dynamically retrieve the backend server address.

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence2

MITRE ATT&CK Mapping Tactic Technique ID Technique Name ... Exfiltration T1041 Exfiltration Over C2 Channel

INDICATORS OF COMPROMISE

IOCs tracked for this family

17 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

7 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

8 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

2 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in apptoday

hash.sha256●●●●●●●●●●●●View more in apptoday

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

malware newsNews

Aug 17, 2026

Operation QUICSILVER: China-Nexus Actor Targets Myanmar Diplomats via VHD-Delivered Go Backdoor - Malware News - Malware Analysis, News and Indicators

A custom Go-based backdoor delivered in a multi-stage VHD/LNK infection chain. It performs sandbox evasion, resolves C2 dynamically via Cloudflare Workers, communicates with its C2 over HTTP/3 using QUIC on UDP/443, encrypts C2 traffic with RC4, collects host information, supports shell/file/directory tasking, and persists via a Startup-folder shortcut.

seqriteNews

Aug 17, 2026

Operation QUICSILVER: China-Nexus Actor Targets Myanmar Diplomats via VHD-Delivered Go Backdoor | Seqrite

Custom Go-based backdoor delivered via VHD/LNK infection chain. It performs sandbox evasion, resolves C2 through Cloudflare Workers, communicates over HTTP/3 using QUIC with RC4-encrypted traffic, collects host information, supports shell/file transfer/directory listing/heartbeat commands, and persists via a Startup-folder shortcut.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching17

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping12

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

QUICAgent

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

12 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566.001Spearphishing AttachmentEvidence2

MITRE ATT&CK Mapping Tactic Technique ID Technique Name Initial Access T1566.001 Phishing: Spearphishing Attachment

Execution

2 techniques

T1059.001PowerShellEvidence2

T1204.002Malicious FileEvidence2

MITRE ATT&CK Mapping Tactic Technique ID Technique Name Initial Access T1566.001 Phishing: Spearphishing Attachment Execution T1204.002 User Execution: Malicious File

Persistence

1 technique

T1547.001Registry Run Keys / Startup FolderEvidence2

To maintain persistence on the infected system, the backdoor creates a shortcut in the current user’s Startup folder.

Privilege Escalation

1 technique

T1547.001Registry Run Keys / Startup FolderEvidence2

To maintain persistence on the infected system, the backdoor creates a shortcut in the current user’s Startup folder.

Stealth

4 techniques

T1027.009Embedded PayloadsEvidence2

T1036.008Masquerade File TypeEvidence2

Although it looked like a PDF document, it was actually a Windows shortcut (LNK) file using a PDF icon to appear legitimate.

T1070.004File DeletionEvidence1

T1218System Binary Proxy ExecutionEvidence2

Once the victim opens the file, the LNK launches ftp.exe, a legitimate Microsoft-signed Windows binary. The threat actor then abuses its -s: option to execute commands stored in a local script file.

Discovery

2 techniques

T1082System Information DiscoveryEvidence2

T1083File and Directory DiscoveryEvidence2

The implant supports five commands that allow the operator to execute commands, transfer files, browse directories, and control the beacon interval.

Command and Control

1 technique

T1102.001Dead Drop ResolverEvidence2

the malware uses two Cloudflare Workers URLs to dynamically retrieve the backend server address.

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence2

MITRE ATT&CK Mapping Tactic Technique ID Technique Name ... Exfiltration T1041 Exfiltration Over C2 Channel

INDICATORS OF COMPROMISE

IOCs tracked for this family

17 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

7 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

8 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

2 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in apptoday

hash.sha256●●●●●●●●●●●●View more in apptoday

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

malware newsNews

Aug 17, 2026

Operation QUICSILVER: China-Nexus Actor Targets Myanmar Diplomats via VHD-Delivered Go Backdoor - Malware News - Malware Analysis, News and Indicators

seqriteNews

Aug 17, 2026

Operation QUICSILVER: China-Nexus Actor Targets Myanmar Diplomats via VHD-Delivered Go Backdoor | Seqrite

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching17

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping12

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.