Operation QUICSILVER: Mustang Panda Deploys QUICAgent Backdoor and COOLCLIENT Kernel Driver Against Myanmar Government

Mustang Panda, a China-nexus APT, is conducting Operation QUICSILVER against Myanmar government entities. The campaign delivers QUICAgent, a Go-based backdoor, and COOLCLIENT, a kernel-mode rootkit driver, via malicious virtual hard disk (VHD) files in spear-phishing emails. QUICAgent establishes command and control over the QUIC protocol to bypass conventional network inspection, while COOLCLIENT provides stealth, persistence, and process/file hiding at the kernel level. The intrusion enables remote command execution, credential harvesting, and exfiltration of sensitive governmental data.

• Incident Overview: Target and Attribution

  • Target: Myanmar government infrastructure and public sector entities.
  • Attribution: Mustang Panda (China-nexus advanced persistent threat group).
  • Objective: Cyber espionage, persistent access, and sensitive data exfiltration.
  • Severity: High.

• Attack Vector: VHD Spear-Phishing Delivery

  • Initial access via malicious virtual hard disk (VHD) attachments.
  • Social engineering lures directed at government personnel.
  • VHD execution bypasses standard executable-based attachment filtering.

• Malware Mechanics: QUICAgent and COOLCLIENT

  • QUICAgent: Go-language backdoor; C2 over QUIC protocol; remote command execution and data exfiltration.
  • COOLCLIENT: Kernel-mode driver; rootkit capabilities for process and file hiding.
  • Combined user-mode and kernel-mode access ensures long-term system presence.

• TTPs and Evasion Techniques

  • QUIC-based C2 communication evades standard TCP/UDP inspection tools.
  • Kernel driver installation subverts OS-level security controls and visibility.
  • VHD lures reduce detection likelihood compared to traditional script or binary payloads.

• Detection and Defensive Actions

  • Monitor for unsigned kernel drivers and anomalous QUIC protocol traffic.
  • Block or sandbox VHD attachments at the email gateway.
  • Audit endpoints for persistence mechanisms linked to COOLCLIENT and QUICAgent artifacts.

• Conclusion: Strategic Implications

  • China-nexus APTs are intensifying focus on Southeast Asian government targets.
  • Kernel-level malware requires advanced endpoint detection and response capabilities.
  • QUIC protocol abuse necessitates updated network visibility and decryption controls.