Operation QUICSILVER: Detecting and Defeating the QUICAgent Go Backdoor Targeting Myanmar Government and IT

---
title: Suspicious Binary Execution from User-Writable Staging Directory
id: 3f8a2c61-9d04-4b7e-a512-8e6f1c0d9a44
status: experimental
description: Detects execution of binaries from user-writable directories commonly used to stage phishing-delivered implants such as the QUICAgent Go backdoor in Operation QUICSILVER.
references:
  - https://thehackernews.com/2026/08/operation-quicsilver-targets-myanmar.html
  - https://attack.mitre.org/techniques/T1204/
author: Security Arsenal
date: 2026/08/10
tags:
  - attack.execution
  - attack.t1204
logsource:
  category: process_creation
  product: windows
detection:
  selection_path:
    Image|contains:
      - '\AppData\Local\Temp\'
      - '\AppData\Roaming\'
      - '\Downloads\'
      - '\Users\Public\'
  filter_installers:
    Image|endswith:
      - '\setup.exe'
      - '\installer.exe'
      - '\update.exe'
  condition: selection_path and not filter_installers
falsepositives:
  - Legitimate portable applications and software updaters running from user profile paths
level: medium
---
title: Non-Browser Process Initiating QUIC (UDP 443) Network Connection
id: 7c1e5b28-4a63-4f91-bd35-2a9c8e0f6b17
status: experimental
description: Detects non-browser processes establishing QUIC (UDP/443) connections, consistent with the QUICAgent backdoor's C2 channel in Operation QUICSILVER. Legitimate QUIC egress is overwhelmingly browser-generated.
references:
  - https://thehackernews.com/2026/08/operation-quicsilver-targets-myanmar.html
  - https://attack.mitre.org/techniques/T1071/
  - https://attack.mitre.org/techniques/T1573/
author: Security Arsenal
date: 2026/08/10
tags:
  - attack.command_and_control
  - attack.t1071
  - attack.t1573
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    DestinationPort: 443
    Protocol: 'udp'
  filter_browsers:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
      - '\brave.exe'
      - '\opera.exe'
      - '\teams.exe'
      - '\slack.exe'
  condition: selection and not filter_browsers
falsepositives:
  - Sanctioned HTTP/3-capable applications (collaboration tools, CDN agents)
  - Cloud sync clients using QUIC transport
level: high
---
title: Persistence via Run Key from User Profile Path
id: 9b4d7e13-6c28-4a5f-9e60-1d3b5f7a2c88
status: experimental
description: Detects registry Run key persistence entries pointing to executables in user-writable profile directories, a common persistence pattern for staged backdoors such as QUICAgent.
references:
  - https://thehackernews.com/2026/08/operation-quicsilver-targets-myanmar.html
  - https://attack.mitre.org/techniques/T1547/001/
author: Security Arsenal
date: 2026/08/10
tags:
  - attack.persistence
  - attack.t1547.001
logsource:
  category: registry_set
  product: windows
detection:
  selection_key:
    TargetObject|contains:
      - '\CurrentVersion\Run'
      - '\CurrentVersion\RunOnce'
  selection_value:
    Details|contains:
      - '\AppData\Local\Temp\'
      - '\AppData\Roaming\'
      - '\Users\Public\'
  condition: selection_key and selection_value
falsepositives:
  - User-mode updaters (e.g., Teams, OneDrive) writing Run keys to profile paths — allowlist by signer
level: high

// Hunt: Non-browser processes making QUIC (UDP/443) connections to non-CDN infrastructure
// Relevant to Operation QUICSILVER / QUICAgent C2 behavior
let KnownQUICApps = dynamic(["chrome.exe","msedge.exe","firefox.exe","brave.exe","opera.exe","teams.exe","slack.exe","onedrive.exe"]);
let KnownQUICDests = dynamic(["google.com","googlevideo.com","cloudflare.com","facebook.com","microsoft.com","akamai.net","fastly.net"]);
DeviceNetworkEvents
| where TimeGenerated > ago(7d)
| where RemotePort == 443
| where InitiatingProcessFileName !in~ (KnownQUICApps)
| extend RemoteHost = tostring(parse_json(AdditionalFields).RemoteHost)
| where RemoteHost !has_any (KnownQUICDests) or isempty(RemoteHost)
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated),
    ConnectionCount=count(), DistinctDestinations=dcount(RemoteIP),
    Destinations=make_set(RemoteIP, 20)
    by DeviceName, InitiatingProcessFileName, InitiatingProcessFolderPath, InitiatingProcessSHA256, AccountName
| where InitiatingProcessFolderPath has_any ("\\AppData\\", "\\Users\\Public\\", "\\Temp\\")
    or ConnectionCount > 50
| sort by ConnectionCount desc;

-- Hunt for staged executables and non-browser QUIC connections on endpoints
-- Operation QUICSILVER / QUICAgent triage artifact
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Exe =~ '(AppData\\\\(Local|Roaming)|Users\\\\Public|Downloads)'
  AND Name !~ '(?i)(onedrive|teams|slack|spotify|discord|dropbox)'

SELECT Pid, Name, Exe,
       netstat().DestIP AS DestIP,
       netstat().DestPort AS DestPort,
       netstat().State AS ConnState
FROM netstat()
WHERE DestPort = 443
  AND Name !~ '(?i)(chrome|msedge|firefox|brave|opera|teams|slack)'

SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs='C:\\Users\\*\\AppData\\Local\\Temp\\*.exe')
WHERE Mtime > (now() - 604800)

# Operation QUICSILVER / QUICAgent endpoint sweep and QUIC egress hardening
# Run elevated on suspect Windows endpoints

# 1) Sweep user-writable staging directories for recently created executables
$stagingPaths = @(
    "$env:SystemDrive\Users\*\AppData\Local\Temp\*.exe",
    "$env:SystemDrive\Users\*\AppData\Roaming\*.exe",
    "$env:SystemDrive\Users\Public\*.exe",
    "$env:SystemDrive\Users\*\Downloads\*.exe"
)
Get-ChildItem -Path $stagingPaths -ErrorAction SilentlyContinue |
    Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-14) } |
    ForEach-Object {
        $sig = Get-AuthenticodeSignature $_.FullName
        [PSCustomObject]@{
            Path       = $_.FullName
            SizeMB     = [math]::Round($_.Length / 1MB, 2)
            Modified   = $_.LastWriteTime
            Signed     = $sig.Status
            SHA256     = (Get-FileHash $_.FullName -Algorithm SHA256).Hash
        }
    } | Format-Table -AutoSize

# 2) Audit Run/RunOnce persistence keys for profile-path binaries
$runKeys = @(
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\Run",
    "HKCU:\Software\Microsoft\Windows\CurrentVersion\RunOnce",
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\Run",
    "HKLM:\Software\Microsoft\Windows\CurrentVersion\RunOnce"
)
foreach ($key in $runKeys) {
    if (Test-Path $key) {
        Get-ItemProperty $key | Get-Member -MemberType NoteProperty | ForEach-Object {
            $val = (Get-ItemProperty $key).($_.Name)
            if ($val -match 'AppData|Users\\Public|Temp') {
                Write-Output "[SUSPICIOUS] $key :: $($_.Name) = $val"
            }
        }
    }
}

# 3) Identify live non-browser processes holding UDP/443 sockets
Get-NetUDPEndpoint -LocalPort * -ErrorAction SilentlyContinue | ForEach-Object {
    $proc = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue
    if ($proc -and $proc.ProcessName -notmatch '^(chrome|msedge|firefox|teams|slack)$') {
        [PSCustomObject]@{
            PID     = $_.OwningProcess
            Process = $proc.ProcessName
            Path    = $proc.Path
        }
    }
} | Sort-Object -Unique Process, Path | Format-Table -AutoSize

# 4) Hardening: block outbound QUIC for non-browser processes at the host firewall
# (Browsers retain HTTP/3; everything else falls back to TCP/443 which is inspectable)
$browserExes = @("chrome.exe","msedge.exe","firefox.exe")
New-NetFirewallRule -DisplayName "Block QUIC egress - non-browser (QUICSILVER hardening)" `
    -Direction Outbound -Protocol UDP -RemotePort 443 -Action Block `
    -Program "C:\Windows\System32\*" -ErrorAction SilentlyContinue | Out-Null
Write-Output "Review firewall policy: prefer proxy-enforced TCP/443 and deny direct UDP/443 egress at the perimeter for non-sanctioned apps."