Loading story…
Seqrite reported that a suspected China-nexus threat actor targeted Myanmar government and diplomatic personnel in Operation QUICSILVER, using Burmese-language lures such as a graduation invitation impersonating Myanmar’s Information Technology and Cyber Security Department. The campaign delivered a .vhd file disguised as an image, containing a malicious .lnk file masquerading as a PDF to trigger execution. Researchers linked multiple 2026 samples to the activity, including HolidayNotice.pdf.exe, TrainingAnnouncement.jpg, and ACMECS_Pillar_1.vhd, indicating a focused intrusion set aimed primarily at Myanmar entities.
The infection chain abused ftp.exe to run a local script, rebuilt the malware from split files named header.doc and body.doc, and deployed a custom Go backdoor dubbed QUICAgent. The malware established persistence through a Startup-folder shortcut, resolved its real command-and-control server through Cloudflare Workers, and communicated over HTTP/3 using QUIC on UDP/443, with RC4 used to encrypt traffic. Seqrite said overlapping tradecraft, infrastructure artifacts, and victimology support a moderate-confidence assessment that the operation is linked to a China-nexus actor.
See the actors and campaigns active against you right now.
9 events from the most recent confirmed update back to the earliest known activity.
Historical DNS showed mediumser.com moving from 38.60.244.141 to 104.64.211.22, the IP later observed handling QUIC-based C2 traffic.
One Burmese-language lure impersonated Myanmar’s Information Technology and Cyber Security Department and referenced a graduation ceremony scheduled at the Ministry of Transport and Communications in Naypyidaw.
Seqrite observed a second VHD sample, ACMECS_Pillar_1.vhd, in July 2026. It shared the same infection chain, payload, and command-and-control infrastructure as the June sample.
Historical DNS records showed mediumser.com resolving to 38.60.244.141 during the first observed hosting period for the campaign infrastructure.
Seqrite observed a VHD-delivered sample named TrainingAnnouncement.jpg in June 2026 as part of the campaign targeting Myanmar government-related personnel. The VHD contained a disguised LNK that launched the QUICAgent infection chain.
Seqrite identified the earliest observed Operation QUICSILVER activity in April 2026 using a sample named HolidayNotice.pdf.exe. The lure was a fabricated Belgian–Myanmar public holiday calendar.
The domain mediumser.com, later used by QUICAgent command-and-control infrastructure, was registered via NameSilo and configured behind Cloudflare DNS.
A threat-research notice identified additional Operation QUICSILVER infrastructure, including maui-cocktailbar.com and two Cloudflare Workers URLs, and published SHA-256 indicators. It also reported that files recovered from the Recycle Bin provided attribution-relevant clues for the China-nexus campaign.
Seqrite publicly documented Operation QUICSILVER as a China-nexus campaign targeting Myanmar government personnel and described the QUICAgent Go backdoor, VHD/LNK delivery chain, Cloudflare Worker-based C2 resolution, and QUIC/HTTP3 communications.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 17 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See the adversaries and campaigns active against your sector right now, ranked by what they're exploiting.
5 references tracked. Mallory keeps watching after this page renders.
community.gurucul.com
Open sourcethehackernews.com
Open sourcecybersecuritynews.com
Open sourcemalware.news
Open sourceseqrite.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers used spear-phishing emails with `TinyURL` links and an actor-controlled redirection server to deliver the **9002 Trojan** from a Google Drive-hosted ZIP archive. The redirection chain embedded a target email address and destination URL in base64-encoded parameters, apparently to track victim clicks, and one lure targeted a legitimate Myanmar politician and human rights activist. The downloaded executable posed as a PowerPoint file, displayed a Myanmar-related conference decoy, and installed malware through **DLL sideloading** by abusing a legitimate RealNetworks executable. Researchers linked the campaign’s infrastructure and beaconing artifacts to broader activity associated with **Poison Ivy**, **PlugX**, **Zupdax**, **HenBox**, and the later-identified **Farseer** malware family. Farseer shared tradecraft including DLL sideloading with signed binaries, encrypted and compressed payloads, obfuscated configuration data, registry persistence, and command-and-control over domains such as `update.tcpdo[.]net`, `honor2020[.]ga`, and `up.outhmail[.]com`. The overlapping infrastructure and Myanmar- and Southeast Asia-themed lures indicate a sustained intrusion set focused on targets in Myanmar, Taiwan, and the wider region.
Aug 15, 2026
Researchers reported that the China-linked espionage group **Mustang Panda** (`TA416`, `RedDelta`, `PKPLUG`) has run a long-lived phishing campaign since at least August 2021 against European diplomatic missions, internet service providers, and research organizations, with many observed victims in Mongolia, Vietnam, and Myanmar and additional targeting in Europe and Africa. The lures used decoy documents tied to current events and government themes, including Ukraine border tensions, COVID-19 travel restrictions, and EU regulations, to entice targets into opening malicious files. The intrusions delivered a previously undocumented **Korplug/PlugX** variant dubbed **Hodur**, continuing a pattern of Mustang Panda PlugX activity seen in earlier Exchange-related and Myanmar-focused operations. The infection chain commonly relied on DLL side-loading with legitimate signed executables such as **SmadAV**, a malicious loader, and an encrypted payload, sometimes preceded by a downloader fetching components over HTTPS. Analysts said the malware introduced stronger obfuscation, encrypted strings and payloads, anti-analysis features, registry or scheduled-task persistence, and encrypted command-and-control over HTTPS or custom TCP with **RC4**, enabling reconnaissance, file theft, remote shell access, and broader espionage operations.
Aug 15, 2026
ESET disclosed a previously undocumented, China-aligned APT group dubbed **GopherWhisper** after uncovering an intrusion affecting about 12 systems at a Mongolian governmental institution, with command-and-control traffic indicating there may be dozens of additional victims. The campaign relied on a largely Go-based malware arsenal—including the **LaxGopher** backdoor, loaders, injectors, file collection and exfiltration tools, and a C++ backdoor called **SSLORDoor**—to maintain access and move data after compromise. The initial access vector remains unknown, but investigators first identified the activity in January 2025 on a Mongolian government system. The group concealed malicious communications inside trusted enterprise traffic by abusing **Slack**, **Discord**, **Microsoft 365 Outlook** draft messages via the Microsoft Graph API, direct encrypted traffic over port 443, and **file.io** for exfiltration and C2 support. ESET said recovered Slack and Discord API tokens, along with thousands of operator messages and Outlook drafts, exposed the attackers’ development workflow, testing environments, and operational mistakes. Metadata such as UTC+8 working hours and locale settings supported the assessment that the actor is China-aligned, while Outlook artifacts showed infrastructure timing including creation of the mailbox `barrantaya.1010@outlook[.]com` and compilation of the **FriendDelivery** DLL in July 2024.
Jun 29, 2026