Chinese

A Chinese-speaking threat cluster tracked as CL-STA-1062 has deployed a newly discovered .NET backdoor, TinyRCT, in targeted campaigns against government and critical energy infrastructure across Southeast Asia during 2025.

The recent campaign combines common open-source tooling with bespoke malware. Operators consistently leverage publicly available utilities SoftEther VPN for tunneling, VNT and yuze for covert command-and-control, and credential harvesters such as Mimikatz often disguising binaries as legitimate system files.

These familiar tools are paired with ASPX web shells used to gain initial footholds via vulnerable web applications. From web-shell access the group stages reconnaissance, executes lateral-movement attempts, and stages data for exfiltration, commonly compressing findings into password protected RAR archives before transfer.

TinyRCT represents a material escalation in tradecraft. Discovered on attacker infrastructure as PerfWatson2.exe, the backdoor is a lightweight C# RAT that enforces strict execution checks: it aborts unless run from %LOCALAPPDATA%, and the associated loader likewise validates execution from the user’s Downloads folder, a tactic designed to frustrate sandbox and analyst analysis.

TinyRCT fingerprints hosts upon launch collecting username, machine name, OS version, local IP addresses, execution path, PID and a GUID encrypts the profile, and registers with a C2 server, establishing a persistent, AES-128-CBC encrypted HTTP channel to 45.32.113[.]172.

Unit 42 said in a report shared with GBhackers , telemetry links this cluster to long-running activity since March 2022 and aligns it with the actor Cisco Talos labeled UAT-7237 for earlier web-hosting attacks in Taiwan, indicating a persistent regional focus and an evolution from opportunistic intrusions.

The malware uses a short beacon interval by default and supports a compact but effective command set: arbitrary shell execution, directory enumeration, file read/download/exfiltration (in 40 KB AES-encrypted chunks), screen capture, configuration updates.

The infection chain reconstructed by analysts shows a socially plausible dropper: a chrome_setup.zip archive containing a signed chrome_setup.exe, a malicious chrome_setup.exe.config and a MyAppDomainManager.dll loader that abuses .NET AppDomainManager injection to run code within the context of a trusted process.

The loader retrieves PerfWatson2.exe from staging infrastructure (139.180.134[.]221), writes it to %LOCALAPPDATA%, and establishes persistence by creating a high-privilege scheduled task (GoogleUpdaterTaskSystem…).

This combination of trusted-process injection, environmental checks, and masquerading increases stealth and longevity in targeted networks.

Observed intrusions in 2025 included database exfiltration from government entities, harvesting of web-server source code, and prolonged access to at least two state-owned critical energy organizations in the same Southeast Asian country.

Telemetry indicates the actor performed reconnaissance to identify lateral pathways and deployed tunneling tools and payloads that bridged initial web compromise to internal asset access.

Detection and mitigation hinge on layered controls: rigorous web-application defenses to block initial ASPX web-shell deployment, strict application allowlisting and behavioral execution controls to prevent execution from nonstandard locations, monitoring for unusual outbound HTTP patterns.

Customers can prioritize endpoint behavioral monitoring and network telemetry to detect TinyRCT’s registration beacons and its characteristic encrypted POSTs.

Organizations suspecting compromise should engage incident response and map inbound staging servers and scheduled tasks to rapidly disrupt persistence.

For additional technical context and defensive guidance, see Unit 42’s attribution framework on CL-STA-1062 and prior reporting by Cisco Talos on UAT-7237, and consult vendor advisories detailing detection rules for TinyRCT and associated tooling.

Note: IP addresses and domains are intentionally defanged (e.g., [.] ) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Mayura Kathir is a cybersecurity reporter at GBHackers News, covering daily incidents including data breaches, malware attacks, cybercrime, vulnerabilities, zero-day exploits, and more.

OpenAI has reportedly delayed the full public release of its -generation AI model, GPT-5.6, following…

Microsoft’s long-planned Secure Boot certificate rollover has reached a critical milestone, impacting more than just…

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical vulnerability affecting Cisco…

A fresh supply-chain wave tied to the Mini Shai-Hulud, Miasma, and Hades malware families is…

Hackers are weaponizing malicious Minecraft Fabric mods to deliver LoaderClient. This stage-one malware loader steals…

Agentic AI transforms Penetration Testing from a periodic consulting practice to a continuous validation discipline.…