CL-STA

Cybersecuritynews •Tushar Subhra Dutta • June 26, 2026

A Chinese-speaking threat group known as CL-STA-1062 has been running a quiet but aggressive campaign against government agencies and critical energy infrastructure across Southeast Asia. The attackers, active since at least March 2022, spent much of 2025 targeting state-owned enterprises with a toolkit that blends widely available open-source utilities with a newly built, custom backdoor […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Chinese APT CL-STA-1062 Deploys TinyRCT Backdoor Against Southeast Asian Targets The Chinese-speaking threat group CL-STA-1062 has been actively deploying a new .NET backdoor named TinyRCT against government and critical energy infrastructure in Southeast Asia throughout 2025. This campaign utilizes a combination of open-source tools and custom malware, including SoftEther VPN for tunneling and Mimikatz for credential harvesting. The TinyRCT backdoor, disguised as PerfWatson2.exe, employs strict execution checks to evade detection and establishes a persistent, encrypted communication channel with its command-and-control server. The group has been linked to ongoing operations since March 2022 and has targeted state-owned enterprises, leading to significant data exfiltration. Observed activities include database breaches and prolonged access to critical energy organizations. The malware's stealthy infection chain involves a socially engineered dropper that leverages trusted processes for execution. 6 sources 78

Extracted Entities

CL-STA

The full story

Extracted Entities

APT Groups (2)

Attack Types (1)

Industries (2)