China-linked attackers attack Myanmar diplomats with fake VHD files

Published August 14, 2026

A China-linked hacking group is tricking Myanmar government and diplomatic staff into opening fake image and PDF files that actually install a hidden backdoor program. Once installed, the backdoor lets the attacker remotely run commands, browse folders, and pull files off the infected computer.

Report priority
Medium
Targets
Myanmar government+2 more

How it works

  • A file that looks like a photo or PDF invitation is really a disguised Windows shortcut.
  • Opening it quietly runs a trusted Windows tool to stitch together hidden pieces into a program that installs itself and phones home to the attacker.

What to do

Anyone in that group who received an unexpected VHD, LNK, or image-named attachment about training notices, holiday calendars, or ASEAN and BIMSTEC affairs should treat it as suspicious and not open it.

Affected organizations should have IT or security staff block or inspect VHD and LNK attachments, watch for the Windows ftp.exe tool launching local scripts, and flag network connections or the IP address 104.64.211.22.

Technical details

Affected software: Myanmar government, Ministry of Transport and Communications, ITCSD

A Myanmar official receives a file called TrainingAnnouncement.jpg that looks like a training notice image. Opening it mounts a hidden disk holding a shortcut disguised as a PDF invitation from a Myanmar ministry training office. Clicking the shortcut shows a real invitation document to avoid suspicion, while behind the scenes it uses a signed Windows tool to merge hidden files into a program named Windowsupdate.exe and runs it. That program then checks in with the attacker's servers every five seconds, waiting for commands to run, send files back, or list folders.

The implant, dubbed QUICAgent, is a 64-bit Go 1.20 backdoor that Seqrite tracks under Operation QUICSILVER, linked with moderate confidence to a China-nexus actor and overlapping with the earlier Operation GriefLure. It delays execution and runs 1,000 SHA-256 operations before beaconing, likely to dodge automated sandbox analysis, then sends RC4-encrypted JSON over HTTP/3 POST requests every five seconds. It resolves its command-and-control address through Cloudflare Workers and communicates over QUIC on UDP/443, using a self-signed 'RAT CA' certificate with custom trust logic instead of standard validation.

Commands include shell, upload, download, list_dir, and set_heartbeat. Persistence is set via a SystemIn.lnk shortcut in the Startup folder that relaunches the payload at every logon.

References

View Original Source