Executive Summary
The Chinese-speaking threat actor CL-STA-1062 (overlapping with UAT-7237) has been identified targeting government entities and state-owned critical energy infrastructure in Southeast Asia throughout 2025. The group utilizes a hybrid toolkit consisting of open-source utilities and a newly discovered, custom-built .NET backdoor named TinyRCT. This actor has demonstrated a sustained regional focus, expanding operations from previous campaigns in Taiwan to strategic sectors across East and Southeast Asia.
The attack chain typically begins with the exploitation of web applications to deploy ASPX web shells, followed by the use of AppDomainManager injection (T1574.014) to load malicious payloads. CL-STA-1062 emphasizes lateral movement and data exfiltration, frequently using tunneling tools and password-protected archives to stage stolen information. The introduction of TinyRCT signifies an evolving capability to develop bespoke malware to maintain persistence and evade detection.
This campaign poses a significant risk to regional stability and critical infrastructure. The actor's ability to exfiltrate entire directories of web server source code and database information highlights a high level of technical proficiency and clear intelligence-gathering objectives.