Chinese-Speaking APT Deploys New TinyRCT Backdoor in Southeast Asia Campaign
Summary: Palo Alto Networks Unit 42 attributed a campaign against government entities and critical infrastructure in Southeast Asia to a Chinese-speaking APT it calls CL-STA-1062, which overlaps with UAT-7237 and has targeted strategic sectors in East Asia since March 2022. The group uses open-source tools such as SoftEther VPN, Mimikatz, and VNT alongside a new .NET backdoor called TinyRCT that runs commands, exfiltrates files, captures screenshots, and deletes itself, and Unit 42 detected breaches of at least 10 organizations in the region between October and December 2025.
What's compelling: Unit 42 observed the attacker staging and exfiltrating an entire directory of web server source code from one government entity while probing a second agency in the same country for lateral movement, and it detected at least 10 breached organizations in a three-month window.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026