Date: 09/03/2026
Severity: High
Summary
Operation QUICSILVER is a China-nexus cyberespionage campaign targeting Myanmar, using a Burmese-language graduation ceremony invitation impersonating Myanmar’s Information Technology and Cybersecurity Department as a lure. The attackers deliver a malicious VHD file containing an -based infection chain, ultimately deploying the Golang QUICAgent backdoor. The campaign primarily targets government and IT organizations, with recovered files from the Recycle Bin providing clues for attribution.
Indicators of Compromise (IOC) List
Domains/URLs | register.mediumser.com maui-cocktailbar.com appupdate.0cmds20cj2cdf8.workers.dev regupdate.eamakfu49dc28wa.workers.dev |
IP Address | 38.60.244.141 104.64.211.22 |
Hash | 26f735cbbb1257be94e6d01656a35bf66a8ae9c34868548d69ec5cb588f9f916
daeac66441b88ba22806f6617058a2dbf1ea0ddcc6c94f291542ea853ac6f9d3
4a1a1b1455c3ea91a3d9203ebff025553227302cede6077e821d303655e2c9f2
aeff39943e254c34187e4a60be3d09d49687439e709eeb4be2b1984310d8ba5c
cd147efe37003399e174951927e5fe727a4481756b116f0204a14a64cc62b059
575305cdaeb1d2187ca6d5ebe32f4c3e3fb53f5ccbe1c0cc257a7f71d84e6f35
c4b4647795567ab15528edd1ab1bf37fb50e21b442e59a653051061973e87c02
0803521a7e9081f46f8f9f61d72371ecc1f49657f10202fffa9a33f581d8bb39
|
Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection
Detection Query 1 : | domainname like "regupdate.eamakfu49dc28wa.workers.dev" or url like "regupdate.eamakfu49dc28wa.workers.dev" or siteurl like "regupdate.eamakfu49dc28wa.workers.dev" or domainname like "appupdate.0cmds20cj2cdf8.workers.dev" or url like "appupdate.0cmds20cj2cdf8.workers.dev" or siteurl like "appupdate.0cmds20cj2cdf8.workers.dev" or domainname like "register.mediumser.com" or url like "register.mediumser.com" or siteurl like "register.mediumser.com" or domainname like "maui-cocktailbar.com" or url like "maui-cocktailbar.com" or siteurl like "maui-cocktailbar.com" |
Detection Query 2 : | dstipaddress IN ("104.64.211.22","38.60.244.141") or srcipaddress IN ("104.64.211.22","38.60.244.141") |
Detection Query 3 : | sha256hash IN ("aeff39943e254c34187e4a60be3d09d49687439e709eeb4be2b1984310d8ba5c","575305cdaeb1d2187ca6d5ebe32f4c3e3fb53f5ccbe1c0cc257a7f71d84e6f35","26f735cbbb1257be94e6d01656a35bf66a8ae9c34868548d69ec5cb588f9f916","daeac66441b88ba22806f6617058a2dbf1ea0ddcc6c94f291542ea853ac6f9d3","0803521a7e9081f46f8f9f61d72371ecc1f49657f10202fffa9a33f581d8bb39","4a1a1b1455c3ea91a3d9203ebff025553227302cede6077e821d303655e2c9f2","c4b4647795567ab15528edd1ab1bf37fb50e21b442e59a653051061973e87c02","cd147efe37003399e174951927e5fe727a4481756b116f0204a14a64cc62b059")
|
Reference:
https://www.seqrite.com/blog/operation-quicsilver-china-nexus-actor-targets-myanmar-diplomats-via-vhd-delivered-go-backdoor/