FlagThis — Daily Cybersecurity Intelligence Briefing

Mustang Panda, a China-nexus APT, is conducting Operation QUICSILVER against Myanmar government entities. The campaign delivers QUICAgent, a Go-based backdoor, and COOLCLIENT, a kernel-mode rootkit driver, via malicious virtual hard disk (VHD) files in spear-phishing emails. QUICAgent establishes command and control over the QUIC protocol to bypass conventional network inspection, while COOLCLIENT provides stealth, persistence, and process/file hiding at the kernel level. The intrusion enables remote command execution, credential harvesting, and exfiltration of sensitive governmental data.