Chinese

Gbhackers •Mayura Kathir • June 26, 2026

A Chinese-speaking threat cluster tracked as CL-STA-1062 has deployed a newly discovered .NET backdoor, TinyRCT, in targeted campaigns against government and critical energy infrastructure across Southeast Asia during 2025. The recent campaign combines common open-source tooling with bespoke malware. Operators consistently leverage publicly available utilities SoftEther VPN for tunneling, VNT and yuze for covert command-and-control, […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Chinese APT CL-STA-1062 Deploys TinyRCT Backdoor Against Southeast Asian Targets The Chinese-speaking threat group CL-STA-1062 has been actively deploying a new .NET backdoor named TinyRCT against government and critical energy infrastructure in Southeast Asia throughout 2025. This campaign utilizes a combination of open-source tools and custom malware, including SoftEther VPN for tunneling and Mimikatz for credential harvesting. The TinyRCT backdoor, disguised as PerfWatson2.exe, employs strict execution checks to evade detection and establishes a persistent, encrypted communication channel with its command-and-control server. The group has been linked to ongoing operations since March 2022 and has targeted state-owned enterprises, leading to significant data exfiltration. Observed activities include database breaches and prolonged access to critical energy organizations. The malware's stealthy infection chain involves a socially engineered dropper that leverages trusted processes for execution. 6 sources 78

Extracted Entities

Chinese

The full story

Extracted Entities

Attack Types (1)

Industries (2)

Malware (1)

MITRE ATT&CK (1)

Tools (3)