Chinese APT CL-STA-1062 Deploys TinyRCT Backdoor Against Southeast Asian Targets

CL-STA-1062, a Chinese-speaking threat actor, has been running a 2025 campaign against Southeast Asian government and energy sectors using a disguised .NET backdoor called TinyRCT; the campaign leverages socially engineered droppers, trusted-process injection, SoftEther VPN, and Mimikatz to maintain persistent, encrypted C2 and exfiltrate data, with activity traced back to March 2022.