CL-STA-1062 Targets Southeast Asian Governments and Critical Infrastructure
Summary: Unit 42 tracked a Chinese-speaking cluster it calls CL-STA-1062, active since at least March 2022, targeting government entities and state-owned energy and government enterprises in Southeast Asia throughout 2025, and assesses with high confidence it is the same cluster Cisco Talos tracks as UAT-7237, previously reported against web hosting infrastructure in Taiwan. In September 2025 the attackers compromised a Southeast Asian government entity using web shells and exfiltrated MSSQL database information, and between October and December 2025 Unit 42 observed the likely compromise of at least ten different organizations in the region, including two state-owned critical energy infrastructure entities.
Bottom line: The group pairs common open-source tools like SoftEther VPN, Mimikatz and VNT with a bespoke, previously undocumented .NET backdoor called TinyRCT, which beacons to its command server every 10 seconds and can self-destruct to erase forensic evidence - so an intrusion here can end with little left to investigate.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- OT / ICS & Critical Infrastructure
- Related
- Siemens RUGGEDCOM APE1808 Cyber Risks · Nov 12, 2026How to Assess OT Incident Response Preparedness Cyber Risks · Nov 10, 2026Three China-Nexus Espionage Campaigns Linked Through Sparrow Malware Ecosystem Cyber Risks · Nov 10, 2026