Unit 42 Details CL-STA-1062 Campaign and TinyRCT Backdoor Targeting Southeast Asia
Summary
Unit 42 reports CL-STA-1062 activity against Southeast Asian government and energy organizations, detailing an intrusion chain and TinyRCT, a previously undocumented backdoor with command execution, file theft, screen capture and self-destruct capabilities.
Key points
- Unit 42 observed CL-STA-1062 activity targeting Southeast Asian government entities and critical energy infrastructure in 2025; it assesses with high confidence that the cluster is the same activity tracked as UAT-7237.
- The observed intrusions used web shells for command execution and reconnaissance, with activity including database and web-server source-code exfiltration.
- The researchers identified TinyRCT, a previously undocumented C# backdoor that supports shell commands, file listing and theft, screen capture, and self-destruction.
- TinyRCT profiles infected hosts and communicates with its C2 over HTTP, encrypting exchanged data with AES-128; it polls at a default 10-second interval.
- The infection chain began with a malicious archive using AppDomainManager injection to load a downloader, retrieve the payload, and establish persistence through a scheduled task.
- The cluster also used tools including SoftEther VPN, VNT, Mimikatz, and JuicyPotato, sometimes disguised as legitimate system or VMware files.
Article Details
- Attack Vectors
- Attackers exploited web applications to deploy ASPX web shells, which they used to run commands, deploy tools, and conduct reconnaissance.
- A malicious chrome_setup.zip archive contained a legitimate executable, a configuration file, and a malicious DLL. The configuration file loaded MyAppDomainManager.dll through AppDomainManager Injection.
- The loader downloaded PerfWatson2.exe from attacker infrastructure and established persistence with a scheduled task configured to run at user logon.
- Attackers used tunneling and open-source tools, including SoftEther VPN, Mimikatz, VNT, and JuicyPotato, and disguised some tools as legitimate system files.
- TinyRCT registered infected hosts and communicated with its C2 server over HTTP; it supported command execution, file theft, and screen capture.
- Defensive Notes
- The article recommends strict behavioral monitoring and execution restrictions for untrusted binaries to block TinyRCT.
- Palo Alto Networks says Cortex XDR and XSIAM use malware prevention capabilities, including Advanced WildFire, Behavioral Threat Protection, and Local Analysis, to prevent known and unknown malware.
- Advanced URL Filtering and Advanced DNS Security identify domains and URLs associated with this activity as malicious.
- Monitor for the described scheduled-task persistence, disguised binaries, and connections to the listed attacker infrastructure.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 139[.]180[.]134[.]221 | Attacker-controlled staging server that hosted PerfWatson2.exe and other campaign payloads. |
| IPV4 | 202[.]182[.]102[.]5 | Listed as an attacker C2 server associated with the campaign. |
| IPV4 | 45[.]32[.]113[.]172 | TinyRCT C2 server used for beaconing and receiving exfiltrated data. |
| IPV4 | 45[.]76[.]210[.]43 | Listed as an attacker C2 server associated with the campaign. |
| SHA256 | 00e09754526d0fe836ba27e3144ae161b0ecd3774abec5560504a16a67f0087c | SHA-256 hash of the malicious chrome_setup.zip archive used in the infection chain. |
| SHA256 | 4e1f8888d020decd09799ec946f1bf677cac6612b24582ddbf4d8ede425d8384 | SHA-256 hash of the TinyRCT backdoor. |
| SHA256 | 9b481b69cd91b09fa7bae7428f646dd89473a4c03393e43da81fe756cde1c472 | SHA-256 hash listed for VNT, which attackers used and disguised as a VMware executable. |
| SHA256 | cbfe8de6ffadbb1d396f61e63eb18e8b11c29527c1528641e3223d4c516cf7c3 | SHA-256 hash of the TinyRCT downloader identified in the campaign. |
| SHA256 | dce5df29bddff5a4ddaea5c4fec14da91f7b69063a6e1c45ed61e5da4fc6c87b | SHA-256 hash of a SoftEther VPN component used by the attackers. |
| SHA256 | f34bd1d485de437fe18360d1e850c3fd64415e49d691e610711d8d232071a0b1 | SHA-256 hash listed for fscan among artifacts associated with the campaign. |
| URL | hxxp[:]//139[.]180[.]134[.]221/PerfWatson2.exe | Attacker-hosted TinyRCT payload identified by the investigation. |
| URL | hxxp[:]//139[.]180[.]134[.]221/sdksdk608/1.zip | Payload URL listed on attacker-controlled infrastructure. |
| URL | hxxp[:]//139[.]180[.]134[.]221/sdksdk608/anydesk%5f0117.zip | Payload URL listed on attacker-controlled infrastructure. |
| URL | hxxp[:]//139[.]180[.]134[.]221/sdksdk608/hamcore.se2 | URL for a SoftEther VPN-related component hosted on attacker-controlled infrastructure. |
| URL | hxxp[:]//139[.]180[.]134[.]221/sdksdk608/httpdf | Payload URL listed on attacker-controlled infrastructure. |
| URL | hxxp[:]//139[.]180[.]134[.]221/sdksdk608/vpn%5fbridge.config | Configuration-file URL listed on attacker-controlled infrastructure. |
| URL | hxxp[:]//139[.]180[.]134[.]221/sdksdk608/win-vpn.rar | Archive URL listed as an attacker-hosted location for the group’s tools. |
MITRE ATT&CK
T1005 · Data from Local SystemAttackers collected database information and web-server source code; TinyRCT could also read and exfiltrate files from infected hosts.T1016 · System Network Configuration DiscoveryTinyRCT collected local IP addresses as part of its host-registration data.T1036 · MasqueradingAttackers disguised malware and tools as legitimate files, including PerfWatson2.exe and vmtools.exe.T1041 · Exfiltration Over C2 ChannelTinyRCT sent exfiltrated files and screen captures to its C2 server using POST requests.T1046 · Network Service DiscoveryAttackers scanned compromised energy entities for vulnerabilities.T1053.005 · Scheduled TaskThe loader created a scheduled task configured to run the malware when the user logged on.T1059.003 · Windows Command ShellTinyRCT executes received commands through cmd.exe or direct process execution.T1068 · Exploitation for Privilege EscalationThe attackers deployed JuicyPotato to escalate privileges.T1070.004 · File DeletionTinyRCT’s self-destruct routine deleted its PerfWatson2 executable.T1071.001 · Web ProtocolsTinyRCT used HTTP GET requests to poll its C2 server and POST requests to register hosts and send data.T1082 · System Information DiscoveryTinyRCT collected the infected host’s username, machine name, and OS version for host profiling.T1105 · Ingress Tool TransferThe loader contacted attacker infrastructure to retrieve the secondary PerfWatson2.exe payload.T1113 · Screen CaptureTinyRCT could capture the infected host’s primary screen and send the capture to its C2 server.T1505.003 · Web ShellThe attackers deployed ASPX web shells on compromised systems to execute commands and maintain access.T1574.014 · AppDomainManagerThe malicious chrome_setup.exe.config file caused the .NET runtime to load MyAppDomainManager.dll as the application manager.
Threat Actors
Malware
Vendors
Products
Advanced DNS SecurityAdvanced URL Filtering and Advanced DNS Security identify known domains and URLs associated with this activity as malicious.Advanced URL FilteringAdvanced URL Filtering and Advanced DNS Security identify known domains and URLs associated with this activity as malicious.Advanced WildFireThis approach combines several layers of protection, including Advanced WildFire, Behavioral Threat Protection and the Local Analysis module, to prevent both known and unknown malware from causing harm to endpoints.Cortex XDRFigure 8 shows how an execution attempt by the TinyRCT malware, masquerading as PerfWatson2.exe, is prevented and alerted by Cortex XDR.XSIAMCortex XDR and XSIAM help to prevent the threats described in this article, by employing the Malware Prevention Engine.
Tools
JuicyPotato#CL-STA-1062MimikatzThe group frequently relied on open-source tooling such as SoftEther VPN, Mimikatz, VNT, and JuicyPotato.SoftEther VPNThe group frequently relied on open-source tooling such as SoftEther VPN, Mimikatz, VNT, and JuicyPotato.VNT#CL-STA-1062YuzeFigure 5 shows the command line used by the group to execute a yuze instance.
Countries
Industries
EnergyCL-STA-1062 is a Chinese-speaking threat cluster that targeted government entities and critical energy infrastructure in Southeast Asia in 2025, using web shells, open-source tools, and a new backdoor called TinyRCT.GovernmentCL-STA-1062 is a Chinese-speaking threat cluster that targeted government entities and critical energy infrastructure in Southeast Asia in 2025, using web shells, open-source tools, and a new backdoor called TinyRCT.