CL-STA-1062 Uses TinyRCT Backdoor in Southeast Asia Campaign
Summary
Unit 42 linked CL-STA-1062 to Southeast Asian government and critical-infrastructure intrusions, reporting breaches at 10 or more organizations in late 2025. It detailed TinyRCT’s capabilities, delivery chain, and encrypted C2.
Key points
- Unit 42 attributed activity targeting government and critical-infrastructure organizations in Southeast Asia to CL-STA-1062, which it said shares overlaps with UAT-7237.
- Unit 42 reported detecting breaches at at least 10 organizations in Southeast Asia between October and December 2025.
- The custom .NET backdoor TinyRCT can execute commands, enumerate and exfiltrate files, capture screenshots, and remove itself; it also avoids running in sandboxed environments.
- TinyRCT is delivered through a ZIP archive containing a legitimate executable and a rogue DLL that uses AppDomainManager injection; the DLL downloads the backdoor.
- TinyRCT communicates with a remote server over HTTP, encrypting exchanged data with AES-128-CBC; it polls for instructions every 10 seconds and sends exfiltrated data via POST.
- The campaign used ASPX web shells for reconnaissance and access, and Unit 42 described data exfiltration from an MS SQL server and staging of web-server source code.
- The actor also used tools including SoftEther VPN, Mimikatz, VNT, and Yuze.
Article Details
- Attack Vectors
- The group scanned regional entities for vulnerabilities, then established footholds through ASPX web shells.
- TinyRCT was delivered in chrome_setup.zip with a legitimate executable, a configuration file, and a rogue DLL that used AppDomainManager injection to load a downloader.
- The downloader contacted an external server to retrieve PerfWatson2.exe; TinyRCT then communicated with its C2 server over HTTP.
- The attackers used web shells to access an MS SQL server and exfiltrate data, and staged and exfiltrated a directory of web-server source code.
- The attackers used SoftEther VPN, Mimikatz, VNT, and Yuze, and disguised some tools as VMware executables or an XDR agent.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 139[.]180[.]134[.]221 | Downloader server contacted to retrieve the PerfWatson2.exe payload. |
| IPV4 | 45[.]32[.]113[.]172 | TinyRCT C2 server contacted over HTTP for instructions and data exchange. |
MITRE ATT&CK
T1036.005 · Match Legitimate Resource Name or LocationThe group disguised tools as VMware executables or an XDR agent, using names such as vmtools.exe and XDRAgent.exe.T1041 · Exfiltration Over C2 ChannelTinyRCT sent exfiltrated data to its C2 server using HTTP POST requests.T1070.004 · File DeletionTinyRCT can delete itself from the compromised host.T1071.001 · Web ProtocolsTinyRCT polled its C2 server using HTTP GET requests and sent data using HTTP POST requests.T1083 · File and Directory DiscoveryTinyRCT can enumerate files, and the attackers staged and exfiltrated a web-server source-code directory.T1090 · ProxyThe group used Yuze, described as a SOCKS5 proxy.T1105 · Ingress Tool TransferThe downloader contacted 139.180.134[.]221 to retrieve PerfWatson2.exe.T1113 · Screen CaptureTinyRCT can capture the compromised device's screen.T1505.003 · Web ShellThe attackers established footholds using ASPX web shells.T1573.001 · Symmetric CryptographyTinyRCT encrypted exchanged data with AES-128 in CBC mode.T1574.014 · AppDomainManagerA rogue DLL in the TinyRCT delivery archive triggered AppDomainManager injection to load the malicious DLL.T1595.002 · Vulnerability ScanningCL-STA-1062 scanned entities in the region for vulnerabilities before establishing footholds.
Threat Actors
Malware
Products
Tools
Mimikatz#CL-STA-1062SoftEther VPNAttackers also relied on open-source tools like SoftEther VPN, Mimikatz, and VNT.VNT#CL-STA-1062YuzeVPN components and RAR archives containing the group’s toolset, including open-source utilities such as Yuze (a SOCKS5 proxy) and VNT (a VPN), often disguising them as VMware executables or an XDR agent (e.g.,
Countries
Industries
Critical infrastructureA Chinese-speaking APT group tracked as CL-STA-1062 has been linked to attacks on government entities and critical infrastructure in Southeast Asia using a new custom backdoor called TinyRCT.EnergyThe campaign combines open-source tools with tailored malware to steal data, maintain access, and target sectors including energy and government.GovernmentA Chinese-speaking APT group tracked as CL-STA-1062 has been linked to attacks on government entities and critical infrastructure in Southeast Asia using a new custom backdoor called TinyRCT.