China-Linked Hackers Strike Asian Critical Infrastructure with TinyRCT Backdoor

Unit 42 uncovered a sustained China-linked APT campaign (CL-STA-1062) targeting government and state-owned energy organizations across Southeast Asia since at least March 2022; the actors used a mix of open-source tooling (SoftEther, Mimikatz, VNT) and a newly observed custom backdoor, TinyRCT, which enables persistent access, arbitrary command execution, file exfiltration, screenshots, encrypted C2, and a self-destruct capability — researchers assess the activity as high-confidence state-linked and observed compromises of multiple critical infrastructure entities in 2025.