China-Nexus Hackers Disguise Malicious VHD as JPEG to Deploy QUICAgent Backdoor
Brief
A China-nexus cyber espionage campaign is using a convincing visual trick to reach Myanmar government and technology personnel.
The attackers present a virtual hard disk, or VHD, as an ordinary JPEG image, betting that recipients will not question a familiar file extension before opening it.
Inside the mounted disk is what appears to be an official Burmese-language graduation invitation from Myanmar’s Information Technology and Cyber Security Department.
The document offers a believable reason to click, while hidden components quietly begin installing a remote access tool called QUICAgent.
Analysts at Seqrite identified the activity as Operation QUICSILVER and assess its China-nexus connection with moderate confidence.
Related lures included a fabricated holiday notice and an ACMECS-themed file, suggesting interest in government and diplomatic personnel.