CL-STA-1062 Hackers Use TinyRCT Backdoor to Target Southeast Asian Governments

Unit 42 and related reporting attribute an ongoing Southeast Asia campaign to a Chinese-speaking group called CL-STA-1062 (also tracked as UAT-7237), which since at least March 2022 — and intensifying in late 2025 — has targeted government and energy organizations using freely available tools (SoftEther, Mimikatz, JuicyPotato) alongside a custom C# backdoor named TinyRCT delivered via a malicious chrome_setup.zip; the report provides TTPs, remediation hints, and detailed IoCs (file hashes, C2 IPs/URLs, filenames).