A Chinese-speaking threat group known as CL-STA-1062 has been running a quiet but aggressive campaign against government agencies and critical energy infrastructure across Southeast Asia. <\/p>\n
The attackers, active since at least March 2022, spent much of 2025 targeting state-owned enterprises with a toolkit that blends widely available open-source utilities<\/a> with a newly built, custom backdoor called TinyRCT.<\/a><\/p>\n The campaign picked up pace in September 2025, when the group broke into a Southeast Asian government network by deploying web shells and pulling database records off an internal MSSQL server. <\/p>\n From there, they expanded their reach by scanning a nearby government entity in the same country, looking for lateral movement opportunities and ways to deepen their foothold. <\/p>\n By the end of the year, between October and December 2025, the group had likely compromised at least ten separate organizations in the region.<\/a><\/p>\n Researchers at Unit 42, Palo Alto Networks\u2019 threat intelligence arm, said in a report<\/a> shared with\u00a0Cyber Security News (CSN)\u00a0that CL-STA-1062 is the same cluster previously tracked by Cisco Talos as UAT-7237, a group that targeted web hosting infrastructure in Taiwan in mid-2025. <\/p>\n The attackers have since shifted focus toward energy and government sectors, pointing to a broader, sustained strategy across the Asia-Pacific region.<\/p>\n What makes this group stand out is how they combine free-to-use tools with their own homegrown malware. <\/p>\n They routinely use SoftEther VPN, Mimikatz, and VNT for tunneling<\/a> and credential theft, often disguising these tools as legitimate VMware executables or trusted system processes. <\/p>\n The introduction of TinyRCT, a previously undocumented backdoor written in C#, marks a notable escalation in the group\u2019s offensive capabilities and reflects a willingness to build custom tools when needed.<\/a><\/p>\n TinyRCT is a lightweight remote access trojan built specifically for Windows systems. It arrives on a victim machine through a malicious archive called chrome_setup.zip, which carries a legitimate-looking Chrome installer alongside a hidden, malicious DLL. <\/p>\n When the user runs the installer, a technique called AppDomainManager Injection quietly loads the malicious code inside the trusted process, keeping it largely out of plain sight.<\/a><\/p>\n Once the loader runs, it checks whether it is executing from the user\u2019s Downloads folder. If not, it terminates immediately, a deliberate trick to dodge sandbox analysis environments. <\/p>\n If the check passes, it contacts a staging server, drops the TinyRCT payload into the local app data directory as PerfWatson2.exe, and registers a scheduled task to keep the infection alive<\/a> across system reboots.<\/a><\/p>\n After settling in, TinyRCT checks in with its command-and-control server every ten seconds. All traffic is encrypted using AES-128, though the encryption key is hard-coded directly inside the binary. <\/p>\n The backdoor can run shell commands, list and read files, download payloads, capture screenshots, and erase itself using a self-destruct routine that leverages choice.exe to introduce a short delay before removing its own files.<\/a><\/p>\n The group\u2019s focus on energy infrastructure makes this campaign especially alarming. <\/p>\n Researchers found that two state-owned energy organizations in the same Southeast Asian country were actively compromised, with attackers scanning for vulnerabilities and downloading malicious payloads onto the infected networks. <\/p>\n Tools were frequently bundled inside password-protected RAR archives to avoid triggering security alerts.<\/a><\/p>\n The attackers used traceroute to map lateral movement paths<\/a> to nearby government systems, and deployed JuicyPotato to escalate privileges once inside a network. <\/p>\n In at least one case, they compressed and exfiltrated an entire directory of web server source code before sending it to attacker-controlled servers. <\/p>\n A comment written in Simplified Chinese found inside TinyRCT\u2019s binary adds to the growing evidence pointing toward Chinese-speaking actors.<\/a><\/p>\n Security teams in Southeast Asia, particularly in energy and government sectors, should watch for untrusted binaries running from local app data directories and unfamiliar scheduled tasks mimicking legitimate service names. <\/p>\n Reviewing outbound HTTP traffic for regular beaconing behavior and enforcing strict policies on where executables are permitted to run are among the most practical defensive steps available against a persistent threat like this.<\/a><\/p>\n Indicators of Compromise (IoCs):-<\/strong><\/p>\n![\"Examples](\"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEggw-Xjx3PWso62VBNURdnIzy00RUcEpCtFed1V1xnLJvtA8KGH1MjwXTyrbTIw_znihCSZM2AGIbXyHKoMM0chr783ji3abetRRDatozuaQ1Ocds370BdmWdfvuRjSXozD5T6Oriy7pgarqb7kmkOVq0LcB5o9RKJtqoXJ0qML1TJoowCB8k5edReBh3o\/s16000\/Examples%2520of%2520outbound%2520requests%2520from%2520an%2520infected%2520network%2520%28Source%2520-%2520Unit42%29.webp?ssl=1\")
CL-STA-1062 Hackers Use TinyRCT Backdoor<\/strong><\/h2>\n
![\"A](\"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEgCO4pKqpC5k4xWZeS70lINsh5Ba1sxkBChb7iPmh92Z5CekWIXryA6nuJOW3o3QAsJyd5JPT9yMlA_SWuhmdBxWR8Wk1gR4plwlXPbotmI1pe5C3jX6l_s8bWrNqViUxlaejnAg01P8-Ox4WOiKnKqU9jqpYwvSiLUwssjIjP3ub7QKPLaMtuWPTcU6i8\/s16000\/A%2520prevention%2520alert%2520of%2520blocking%2520the%2520TinyRCT%2520malware%2520execution%2520attempt%2520%28Source%2520-%2520Unit42%29.webp?ssl=1\")
Critical Infrastructure Under Attack<\/strong><\/h2>\n