TLDR Tech / InfoSec
CL-STA-1062 Targets Southeast Asian Governments and Critical Infrastructure
Unit 42 attributes a sustained 2025 campaign against Southeast Asian government and state-owned energy entities to CL-STA-1062, a Chinese-speaking cluster active since at least March 2022 that it assesses with high confidence to be the same actor Cisco Talos tracks as UAT-7237. The group pairs commodity tooling such as SoftEther VPN, Mimikatz, VNT, and JuicyPotato with TinyRCT, a previously undocumented C#/.NET backdoor delivered via AppDomainManager injection that supports arbitrary command execution, file exfiltration, screen capture, and a self-destruct routine that scrubs forensic artifacts. The progression from Taiwanese web hosting infrastructure to regional critical energy and government targets signals a broadening Asia-Pacific espionage focus, and the shift toward bespoke malware suggests CL-STA-1062 will remain a durable threat to the region's strategic sectors.
Read the full story