Chinese-Speaking CL-STA-1062 Used TinyRCT to Breach Southeast Asian Governments

Palo Alto Networks Unit 42 reported that the Chinese-speaking intrusion cluster CL-STA-1062, assessed with high confidence to overlap with Cisco Talos' UAT-7237, conducted sustained operations across East and Southeast Asia from at least 2022 through 2025. In 2025, the group targeted Southeast Asian government entities and state-owned critical energy infrastructure, using web application exploitation, ASPX web shells, reconnaissance, lateral movement, and data exfiltration to maintain access and steal information.

Investigators said the actors combined open-source tooling including SoftEther VPN, VNT, yuze, Mimikatz, and JuicyPotato with a newly documented custom .NET backdoor, TinyRCT. The malware supports command execution, file listing and exfiltration, screenshot capture, encrypted HTTP-based command-and-control, and a self-destruct feature intended to erase forensic evidence. Unit 42 also reconstructed an infection chain in which a malicious chrome_setup.zip archive used AppDomainManager Injection to load a malicious DLL, download PerfWatson2.exe from attacker infrastructure, and establish persistence through a scheduled task.