A sophisticated cyber espionage operation linked to China is leveraging a clever visual deception to infiltrate Myanmar’s government and tech sectors. Hackers are disguising a virtual hard disk (VHD) as a harmless JPEG image, hoping that recipients will not scrutinize the file extension before opening it.
Deceptive Techniques and Targets
The malicious VHD, once opened, reveals what appears to be a legitimate Burmese-language graduation invitation, supposedly from Myanmar’s Information Technology and Cyber Security Department. This document serves as a decoy, encouraging the recipient to click, while in the background, a remote access tool known as QUICAgent is quietly installed.
Seqrite’s analysts have identified this campaign as Operation QUICSILVER, associating it with Chinese origin with moderate confidence. The operation employs familiar Windows features and social engineering tactics, targeting government and diplomatic personnel through various lures, including fake holiday notices and ACMECS-themed files.
Infection Strategy and Risks
The initial file masquerades as a typical JPEG image but is significantly larger in size, revealing its true format as a VHD upon closer inspection. Within this mounted disk, an apparent PDF with an icon is actually a Windows shortcut (LNK file). This method exploits Windows’ tendency to suppress known file extensions, presenting a legitimate-looking document name instead of the shortcut suffix.
After the shortcut is executed, it activates the Windows utility ftp.exe to run commands from a local script, unveiling the decoy invitation while clandestinely assembling the malicious payload in the user’s application-data folder. This strategy highlights the persistent threat of malicious LNK file campaigns for targeted organizations.
QUICAgent’s Advanced Evasion Techniques
QUICAgent, a custom 64-bit Go backdoor, is designed to evade quick detection by performing intensive hashing tasks before it contacts its operators. Instead of embedding the command server details directly, QUICAgent queries Cloudflare Workers pages to obtain the active address, communicating over QUIC protocol on UDP port 443 with RC4 encryption.
This layered infrastructure facilitates easy changes and masks malicious traffic among routine encrypted connections. Once established, the backdoor collects system information, maintains regular check-ins, and persists by creating a shortcut in the user’s Startup folder.
Security teams should monitor for unusual shortcut creation in Startup folders, unexpected ftp.exe activity, and outbound QUIC connections, correlating these indicators with known espionage activities to identify broader targeted campaigns.
To prevent such incidents, organizations should scrutinize all unexpected disk-image files, regulate VHD mounting, and educate staff on handling unsolicited documents, particularly those claiming urgency or official status.
