TinyRCT Backdoor Gives CL-STA-1062 Command Execution and File Exfiltration Capabilities

This report describes a 2025 APT campaign by CL-STA-1062 targeting government and energy organizations in Southeast Asia that used exploited web applications to deploy ASPX web shells, open-source tunneling tools disguised as legitimate binaries, and a newly identified custom remote access Trojan called TinyRCT for stealthy data theft, lateral movement, and persistent access; the report includes technical TTPs and multiple SHA256 IoCs tied to the activity.