China Hackers Use Malicious VHD Disguised as JPEG to Deploy QUICAgent Backdoor

Key Takeaways

• A China-linked cyber espionage group, dubbed “Operation QUICSILVER,” is targeting Myanmar government and technology sectors.
• Attackers are employing sophisticated social engineering by disguising malicious Virtual Hard Disks (VHDs) as benign JPEG image files.
• The campaign aims to deploy the custom QUICAgent backdoor, a 64-bit Go-based remote access tool.
• The backdoor leverages Cloudflare Workers for command-and-control (C2) infrastructure, enhancing stealth and resilience.

A sophisticated cyber espionage campaign, linked to Chinese state-sponsored actors, is actively targeting government and technology personnel in Myanmar. This operation, identified as “Operation QUICSILVER” by security researchers, employs a deceptive tactic: presenting malicious virtual hard disk (VHD) files as harmless JPEG images to bypass initial scrutiny and deploy a custom backdoor known as QUICAgent.

Analysts at Seqrite said in a report that the threat actors are leveraging common Windows features in conjunction with clever social engineering to craft a seemingly innocuous infection chain. This approach highlights the persistent threat posed by malicious LNK file campaigns, which continue to be effective against targeted organizations.

The Deceptive Delivery Mechanism

The initial vector in Operation QUICSILVER is a virtual hard disk (VHD) file, cunningly named to appear as a standard JPEG image. Despite the misleading file extension, the VHD’s significantly larger file size compared to a typical photograph could serve as a red flag for vigilant users. Upon mounting the VHD, victims are presented with what appears to be a single PDF document, complete with a familiar PDF icon.

However, this “PDF” is, in reality, a Windows shortcut file (LNK). Windows operating systems often hide common file extensions by default, making it difficult for users to discern the true nature of the file. This tactic is a known method for weaponizing document shortcut files, transforming a seemingly trusted attachment into the first stage of a cyber intrusion.

Once a victim clicks the deceptive shortcut, it executes the legitimate Windows utility ftp.exe. This utility is then instructed to run commands from a local script embedded within the VHD. The script’s primary function is twofold: it first displays a decoy document—a fabricated Burmese-language graduation invitation from Myanmar’s Information Technology and Cyber Security Department—to distract the user. Simultaneously, it concatenates two hidden files, also disguised as documents, to reconstruct and launch the QUICAgent payload in the user’s local application data folder.

Researchers investigating the virtual disk’s Recycle Bin discovered deleted files that, while not part of the direct lure, offered insight into the campaign’s objectives. References to ASEAN, BIMSTEC, United Nations meetings, and Myanmar diplomacy strongly suggest an intelligence-gathering focus on governmental and diplomatic entities.

QUICAgent: A Stealthy Go Backdoor

QUICAgent is a bespoke 64-bit backdoor written in Go, designed with stealth and evasion in mind. It incorporates a unique delay mechanism: before attempting to establish contact with its command-and-control (C2) infrastructure, the malware pauses and performs computationally intensive hashing operations. This behavior is intended to consume valuable time in automated analysis environments, hindering rapid detection and allowing the implant to progress to subsequent stages undetected.

For its C2 communications, QUICAgent does not hardcode the server address directly within its binary. Instead, it queries Cloudflare Workers pages to retrieve the active C2 address. This dynamic approach enhances the malware’s resilience against takedowns and makes infrastructure changes easier for the attackers. Communication then proceeds over the QUIC protocol (UDP port 443), with traffic further obscured using RC4 encryption. This layered strategy allows malicious traffic to blend in with legitimate encrypted web connections, mirroring a broader trend of backdoors leveraging trusted cloud services for obfuscation.

Upon successful establishment, QUICAgent collects the victim’s computer DNS name and logged-in username. It maintains persistence by creating a shortcut in the current user’s Startup folder, ensuring the backdoor reactivates upon user login. By default, the backdoor checks in every five seconds and is capable of executing commands, transferring files, listing directories, and modifying its check-in interval.

What You Should Do

• Exercise Caution with Attachments: Treat all unsolicited documents, especially those claiming to be official or time-sensitive, with extreme skepticism. Verify the sender’s identity and the legitimacy of the content through alternative communication channels before opening.
• Scrutinize File Extensions and Sizes: Train users to recognize that file icons and displayed extensions are not always reliable indicators of a file’s true type. Encourage them to be suspicious of unexpected disk image files (e.g., .VHD, .ISO) and files with unusually large sizes for their purported type (e.g., a “JPEG” that is many megabytes).
• Restrict VHD Mounting: Where not strictly necessary for business operations, restrict or closely monitor the mounting of virtual hard disk files on endpoints. Implement policies that prevent automatic mounting or require administrative approval.
• Monitor for Suspicious Activity: Implement robust endpoint detection and response (EDR) solutions to monitor for unusual process activity, such as ftp.exe being used to run scripts, or suspicious shortcut creations in user Startup folders.
• Inspect Outbound QUIC Traffic: Monitor network traffic for outbound QUIC (UDP port 443) connections from endpoints that typically do not have a business need for this protocol. Correlate these alerts with other indicators of compromise.
• Leverage Threat Intelligence: Integrate the provided Indicators of Compromise (IoCs) into your security information and event management (SIEM) systems, firewalls, and endpoint protection platforms for blocking, hunting, and retrospective analysis. Remember to defang IP addresses and domains before use in active systems.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.