China-Nexus Hackers Use Deceptive VHD Files Masquerading as JPEGs to Deploy QUICAgent Backdoor
A sophisticated cyber espionage campaign attributed to China-nexus threat actors is targeting Myanmar government and technology personnel by disguising malicious VHD files as JPEG images, leading to the deployment of the QUICAgent backdoor.
A China-nexus cyber espionage campaign is employing a sophisticated social engineering tactic to target Myanmar government and technology personnel. The attackers are disguising malicious Virtual Hard Disk (VHD) files as ordinary JPEG images, leveraging the familiarity of the file extension to trick victims into opening them. This campaign, identified by Seqrite analysts as Operation QUICSILVER, exhibits a moderate confidence link to China-nexus threat actors.
Upon opening the disguised VHD file, victims are presented with a seemingly legitimate, Burmese-language graduation invitation, purportedly from Myanmar’s Information Technology and Cyber Security Department. This lure is designed to provide a believable reason for the user to interact further with the malicious content. Hidden within the VHD are components that quietly begin the installation process for QUICAgent, a custom Go-based backdoor.
Other lures observed in this operation include a fabricated holiday notice and a file themed around ACMECS (ASEAN-related bodies), suggesting a focus on government and diplomatic entities. The infection chain cleverly combines routine Windows features with social engineering. A fake image file, a document-shaped shortcut (LNK file), and a legitimate system program like ftp.exe are used in sequence to make the malicious activity appear harmless.
When researchers examined the initial file, they discovered it was a VHD significantly larger than a typical photograph. After mounting the VHD, a single file masquerading as a PDF document was visible, complete with a PDF icon. However, this was actually a Windows shortcut (LNK file). Windows' default behavior of suppressing familiar file extensions means users see a benign document name rather than the true nature of the file.
Once the victim clicks the shortcut, it invokes the signed Windows utility ftp.exe to execute commands from a local script. This script then displays the decoy invitation to the user while simultaneously reconstructing and launching the actual payload from two concealed files within the user's local application-data folder. This technique highlights the danger of relying on file icons and displayed extensions as indicators of a file's true type.
The QUICAgent backdoor is designed to evade automated analysis by pausing and performing intensive hashing work, consuming valuable time before contacting its command and control (C2) infrastructure. Instead of hardcoding C2 server addresses, QUICAgent queries Cloudflare Workers pages to obtain the active address. Communication is established over QUIC on UDP port 443 and encrypted using RC4, making it difficult to distinguish from legitimate encrypted web traffic.
Once established, QUICAgent collects the computer's DNS name and the logged-in username, checks in with the C2 server every five seconds by default, and can execute commands, transfer files, list directories, or modify its check-in interval. To ensure persistence, it creates a shortcut in the current user's Startup folder, ensuring the backdoor reactivates upon user login. Security teams are advised to hunt for suspicious shortcut creation in Startup folders, unusual ftp.exe activity, and outbound QUIC connections from endpoints without a legitimate need for them.