Operation QUICSILVER: China-Nexus VHD-Delivered Go Backdoor and FTP Dead Drop RATs — Defender's Detection and Response Guide

---
title: Virtual Disk Image File Created in User-Writable Location
description: Detects creation of VHD/VHDX/ISO/IMG container files in user directories, consistent with phishing-delivered container payloads used in Operation QUICSILVER. These containers bypass Mark-of-the-Web propagation and are rarely created by end users.
references:
  - https://securityaffairs.com/198133/malware/security-affairs-malware-newsletter-round-112.html
  - https://attack.mitre.org/techniques/T1566/001/
author: Security Arsenal
date: 2026/08/10
tags:
  - attack.initial_access
  - attack.t1566.001
logsource:
  category: file_event
  product: windows
detection:
  selection_ext:
    TargetFilename|endswith:
      - '.vhd'
      - '.vhdx'
      - '.iso'
      - '.img'
  selection_path:
    TargetFilename|contains:
      - '\Users\'
      - '\AppData\Local\Temp\'
      - '\Downloads\'
      - '\Desktop\'
  filter_archive_tool:
    Image|endswith:
      - '\7z.exe'
      - '\winrar.exe'
      - '\ explorer.exe'
  condition: selection_ext and selection_path and not filter_archive_tool
falsepositives:
  - IT administrators deploying virtual machines
  - Users legitimately receiving disk images from software vendors
level: high
---
title: Mount-DiskImage or Diskpart Mounting of Virtual Disk via Command Line
description: Detects interactive or scripted mounting of virtual disk images through PowerShell Mount-DiskImage or diskpart, a step in VHD-delivered malware execution chains. While double-click mounting via Explorer is more common, adversaries and scripts frequently mount images programmatically.
references:
  - https://securityaffairs.com/198133/malware/security-affairs-malware-newsletter-round-112.html
  - https://attack.mitre.org/techniques/T1059/001/
author: Security Arsenal
date: 2026/08/10
tags:
  - attack.execution
  - attack.t1059.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_ps:
    CommandLine|contains:
      - 'Mount-DiskImage'
      - 'Mount-VHD'
      - 'Add-PartitionAccessPath'
  selection_diskpart:
    Image|endswith: '\diskpart.exe'
    CommandLine|contains:
      - 'vdisk'
      - 'attach'
  condition: selection_ps or selection_diskpart
falsepositives:
  - Legitimate virtualization administration by IT staff
  - Backup and recovery tooling
level: medium
---
title: Outbound FTP Connection from Non-FTP Client Process
description: Detects workstation processes initiating outbound connections to TCP/21 that are not recognized FTP clients. Consistent with implants using FTP banners as dead drop resolvers or FTP as a staging/exfiltration channel. Legitimate interactive FTP from end-user workstations is exceptionally rare in modern environments.
references:
  - https://securityaffairs.com/198133/malware/security-affairs-malware-newsletter-round-112.html
  - https://attack.mitre.org/techniques/T1071/002/
  - https://attack.mitre.org/techniques/T1102/
author: Security Arsenal
date: 2026/08/10
tags:
  - attack.command_and_control
  - attack.t1071.002
  - attack.t1102
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort: 21
    Initiated: 'true'
  filter_known_clients:
    Image|endswith:
      - '\ftp.exe'
      - '\FileZilla.exe'
      - '\WinSCP.exe'
      - '\psftp.exe'
      - '\curl.exe'
  condition: selection and not filter_known_clients
falsepositives:
  - Legacy line-of-business applications with embedded FTP transfers (tune per-environment by Image hash)
level: high

// Hunt: VHD-delivered malware + FTP dead drop resolver behavior (Operation QUICSILVER / FTP banner RATs)
// Part 1: Virtual disk container files landing in user-writable paths
let ContainerFiles =
DeviceFileEvents
| where TimeGenerated > ago(14d)
| where FileName has_any (".vhd", ".vhdx", ".iso", ".img")
| where FolderPath has_any ("\\Users\\", "\\Downloads\\", "\\Desktop\\", "\\AppData\\Local\\Temp\\")
| project ContainerTime=TimeGenerated, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName, InitiatingProcessCommandLine;
// Part 2: Outbound FTP (TCP/21) from non-standard processes
let FtpEgress =
DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where RemotePort == 21
| where InitiatingProcessFileName !in~ ("ftp.exe", "FileZilla.exe", "WinSCP.exe", "curl.exe", "psftp.exe")
| where RemoteIPType == "Public"
| project FtpTime=TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl;
ContainerFiles
| join kind=fullouter FtpEgress on DeviceName
| order by DeviceName asc

// Correlation: host wrote a disk container AND spawned processes shortly after (mount + execute chain)
DeviceFileEvents
| where TimeGenerated > ago(14d)
| where FileName endswith ".vhd" or FileName endswith ".vhdx"
| extend DeviceName, FileWriteTime = TimeGenerated
| join kind=inner (
    DeviceProcessEvents
    | where TimeGenerated > ago(14d)
    | where ProcessCommandLine has_any ("Mount-DiskImage", "diskpart", "vdisk")
       or FileName in~ ("rundll32.exe", "regsvr32.exe", "wscript.exe", "mshta.exe")
) on DeviceName
| where TimeGenerated between (FileWriteTime .. FileWriteTime + 15m)
| project DeviceName, FileWriteTime, FileName, FolderPath, ProcessExecTime=TimeGenerated, FileName1=FileName, ProcessCommandLine, AccountName

-- Hunt: VHD container artifacts and suspicious FTP (TCP/21) egress on Windows endpoints
-- Combines filesystem artifact sweep with live network state for dead drop resolver detection

SELECT * FROM foreach(
  row={
    SELECT FullPath, Size, Mtime
    FROM glob(globs=['C:/Users/*/Downloads/*.vhd',
                     'C:/Users/*/Downloads/*.vhdx',
                     'C:/Users/*/Downloads/*.iso',
                     'C:/Users/*/Desktop/*.vhd',
                     'C:/Users/*/Desktop/*.vhdx',
                     'C:/Users/*/AppData/Local/Temp/*.vhd*'])
    WHERE Mtime > now() - 1209600
  },
  query={
    SELECT FullPath AS SuspiciousContainer, Mtime AS ContainerWritten
    FROM scope()
})

SELECT Pid, Name, Path AS ProcessPath, CommandLine
FROM pslist()
WHERE CommandLine =~ 'Mount-DiskImage|diskpart|attach vdisk'

SELECT Pid, Name, Status, Laddr, Raddr
FROM netstat()
WHERE Raddr =~ ':21$'
  AND Status =~ 'ESTABLISHED|SYN'

# Security Arsenal — QUICSILVER / VHD-Malware Endpoint Verification Script
# Run elevated on endpoints or deploy via your RMM/Intune. Read-only audit; safe for production.

# 1. Enumerate currently mounted virtual disk images
Write-Host "[*] Mounted virtual disk images:" -ForegroundColor Cyan
Get-DiskImage | Where-Object { $_.Attached -eq $true } |
    Select-Object ImagePath, Attached, DevicePath | Format-Table -AutoSize

# 2. Sweep user profiles for recently written container files (last 14 days)
$cutoff = (Get-Date).AddDays(-14)
$containers = Get-ChildItem -Path "C:\Users" -Recurse -Include *.vhd,*.vhdx,*.iso,*.img -ErrorAction SilentlyContinue |
    Where-Object { $_.LastWriteTime -gt $cutoff }
Write-Host "[*] Container files written in last 14 days: $($containers.Count)" -ForegroundColor Cyan
$containers | Select-Object FullName, Length, LastWriteTime | Format-Table -AutoSize

# 3. Audit outbound TCP/21 listeners of history via established connections (point-in-time)
Write-Host "[*] Active outbound FTP (TCP/21) connections:" -ForegroundColor Cyan
Get-NetTCPConnection -RemotePort 21 -ErrorAction SilentlyContinue |
    Where-Object { $_.State -eq 'Established' } |
    ForEach-Object {
        $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
        [PSCustomObject]@{ RemoteAddress=$_.RemoteAddress; Process=$proc.ProcessName; Path=$proc.Path }
    } | Format-Table -AutoSize

# 4. Verify ASR rules relevant to container/child-process abuse (Audit or Block)
Write-Host "[*] Attack Surface Reduction rule states:" -ForegroundColor Cyan
$asr = Get-MpPreference
$asr.AttackSurfaceReductionRules_Ids | ForEach-Object {
    $i = $asr.AttackSurfaceReductionRules_Ids.IndexOf($_)
    [PSCustomObject]@{ RuleId=$_; State=$asr.AttackSurfaceReductionRules_Actions[$i] }
} | Format-Table -AutoSize
# Recommended: enable "Block executable files from running unless they meet prevalence/age/trusted list"
# (rule 01443614-cd74-433a-b99e-2ecdc07bfc25) in Block mode after a 2-week audit period.

# 5. Verify Defender SmartScreen and MOTW handling are not weakened
$motw = Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Attachments" -ErrorAction SilentlyContinue
Write-Host "[*] SaveZoneInformation policy (1 = preserve MOTW): $($motw.SaveZoneInformation)" -ForegroundColor Cyan