Chinese APT CL-STA-1062 Expands Attacks on Southeast Asian Critical Infrastructure With Custom Malware

Chinese-speaking APT CL-STA-1062 targeted Southeast Asian government and energy networks open-source tools, and a new TinyRCT backdoor.

Palo Alto Networks Unit 42 researchers published a detailed report on a Chinese-speaking threat actor, tracked as CL-STA-1062, that has been running persistent operations across East Asia since at least March 2022 and shifted focus to Southeast Asian government entities and state-owned critical energy infrastructure from mid-2025 onward.

The same group was previously flagged by Cisco Talos as UAT-7237, linked to campaigns against web hosting infrastructure in Taiwan. Between October and December 2025 alone, Unit 42 detected breaches at a minimum of ten different organizations in the region.

The intrusion pattern is consistent across targets. The attackers get in through ASPX web shells deployed against vulnerable web applications, use those shells for reconnaissance and tool delivery, and then establish persistent tunneling infrastructure using SoftEther VPN, Yuze, and VNT, all disguised as VMware executables or XDR agents with names like vmtools.exe, vmwared.exe, and XDRAgent.exe.

“From a technical standpoint, the attackers behind CL-STA-1062 rely on a hybrid toolkit.” reads the report published by Unit42. “While they frequently use common open-source tools such as SoftEther VPN, Mimikatz, and VNT, they have recently introduced TinyRCT, a bespoke, previously undocumented backdoor.”

In September 2025, Unit 42 observed the group compromise a Southeast Asian government entity, deploy a web shell, and exfiltrate data from an MS SQL server. During the same intrusion, they conducted network reconnaissance against a separate government entity in the same country, mapping potential lateral movement paths using traceroute.

“During this intrusion, the attackers were also able to conduct network reconnaissance on a separate government entity in the same country. This suggests an effort to identify lateral movement opportunities and broaden their access.” continues the report. “In one case, we observed the attacker staging and exfiltrating an entire directory of web server source code from the government entity”

Attackers leverage known open-source tools, such as JuicyPotato, to achieve privilege escalation. Stolen data was compressed into password-protected RAR archives before exfiltration.

TinyRCT is the technically interesting addition to this campaign. Unit 42 found it hosted on attacker infrastructure at 139.180.134[.]221 under the filename PerfWatson2.exe, a name chosen to mimic the legitimate Microsoft Visual Studio telemetry component.

It’s a lightweight C# backdoor that runs arbitrary commands via cmd.exe, enumerates directories and files, reads and exfiltrates files in 40KB gzip-compressed AES-encrypted chunks, captures screenshots as JPEG, downloads files from URLs, and deletes itself on command. The C2 address is hardcoded at 45.32.113[.]172, communicating over plain HTTP with AES-128 CBC encryption using a hardcoded key: ThisIsASecretKey87654321. The default polling interval is 10 seconds.

TinyRCT does two things to avoid analysts. On launch, it checks that it’s running from %LOCALAPPDATA%. If not, it terminates immediately. The code contains a line in Simplified Chinese inside the C2 response parsing function, a detail that points directly at the language background of whoever wrote it. The self-destruct routine uses choice.exe to introduce a three-second delay before deleting the primary executable, ensuring the process has fully exited and released its file handle before the deletion command runs. It also removes the persistence scheduled task it created on the way in.

Delivery comes via chrome_setup.zip, an archive containing three files: a legitimate signed chrome_setup.exe, a malicious chrome_setup.exe.config configuration file, and a rogue DLL named MyAppDomainManager.dll. When the user runs the legitimate executable, the .NET runtime reads the adjacent config file and loads the malicious DLL as the application domain manager, executing within the context of a trusted process. The loader then checks that it’s running from the user’s Downloads directory, contacts the staging server to retrieve PerfWatson2.exe, and creates a scheduled task named GoogleUpdaterTaskSystem140.0.7272.0 set to run at the highest available privileges on every user login.

“The combination of tools observed in this activity cluster reflects a pragmatic approach to tool selection and attack capabilities. The attackers behind this cluster continue to leverage common open-source tools such as SoftEther VPN and VNT to facilitate lateral movement.” concludes the report.”Our discovery of the TinyRCT backdoor in the attackers’ infrastructure underscores their ability to customize tools to gain specific capabilities.”

The use of off-the-shelf tools for most of the operation keeps attribution harder and development costs low, while the custom backdoor fills the specific gap those tools can’t cover: long-term, low-visibility persistence with a clean exit option. Unit 42 assesses this activity will continue and expand, with Southeast Asian energy and government organizations remaining the primary targets.

CL-STA-1062 continues to threaten Southeast Asia, particularly energy and government organizations, through attacks on critical infrastructure and the use of custom malware.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, China)