Cybersecurity researchers have identified a targeted espionage campaign named Operation QUICSILVER that has been active against Myanmar's government and information technology sectors since mid-2026. The operation uses deceptive graduation ceremony invitations as lures to deliver a custom Go-based malware called QUICAgent, designed to establish persistent access on compromised systems. The campaign was uncovered in August 2026 by threat intelligence analysts monitoring regional cyber threats.
The attackers craft convincing fake event invitations that appear to come from legitimate academic or institutional sources, exploiting the cultural significance of graduation ceremonies in Myanmar. Once opened, these documents trigger the download and execution of QUICAgent, which communicates with command-and-control servers using the QUIC protocol to evade traditional network detection. The malware enables data exfiltration, screenshot capture, and remote command execution, with a focus on harvesting sensitive governmental and technical information.
QUICAgent leverages the QUIC protocol, originally designed for faster web traffic, to blend malicious communications with legitimate HTTPS-like traffic. This allows the backdoor to bypass firewalls and intrusion detection systems that do not deeply inspect QUIC-encrypted streams. Researchers noted the malware includes modular components that can be updated remotely, suggesting ongoing development and adaptation by the threat actors. The use of culturally relevant lures indicates a deep understanding of local contexts, increasing the likelihood of successful social engineering.
Defending against campaigns like Operation QUICSILVER requires a combination of technical controls and user awareness training. Organizations should implement protocol-aware network monitoring capable of analyzing QUIC traffic for anomalies, alongside endpoint detection and response tools that flag unusual process behaviors. Regular phishing simulations targeting culturally relevant lures can improve employee vigilance. Additionally, restricting execution of unsigned scripts and limiting administrative privileges reduce the risk of malware persistence even if initial infection occurs.
What is the primary goal of Operation QUICSILVER? The campaign aims to steal sensitive data from Myanmar’s government and IT sectors through stealthy backdoor access for espionage purposes.
How does QUICAgent avoid detection by security tools? It uses the QUIC protocol to mask its network traffic as legitimate web traffic, evading standard inspection methods that focus on HTTP/HTTPS.
Who is believed to be behind the attack? Researchers have not publicly attributed the campaign to any specific group or nation-state, citing insufficient evidence for definitive attribution.