AI Weekly Malaysia

Operation QUICSILVER is a cyber espionage campaign targeting Myanmar's government and IT sectors, attributed with moderate confidence to a China-nexus threat actor. Active since April 2026, it uses VHD files containing LNK shortcuts disguised as Burmese-language graduation ceremony invitations to deliver QUICAgent, a Go-based backdoor that communicates over QUIC/UDP 443 and uses Cloudflare Workers domains for dynamic C2 address retrieval.

Why: For builders in Southeast Asia, the notable technical patterns are abuse of Cloudflare Workers as C2 infrastructure and QUIC over UDP 443 for covert comms—techniques that could appear in copycat attacks. If you operate infrastructure in the region, review whether your Cloudflare Workers usage or QUIC traffic patterns could be flagged by threat intel, and consider whether your org's phishing defenses handle VHD/LNK-based lures.