Chinese-Speaking APT Deploys New TinyRCT Backdoor in Southeast Asia Campaign

The CL-STA-1062 threat group has been conducting sustained cyber espionage against government entities and critical infrastructure in Southeast Asia since at least March 2022, leveraging a custom backdoor (TinyRCT) to enable stealthy data exfiltration and network reconnaissance. The multi-year dwell time suggests significant failures in threat detection and anomalous network traffic monitoring, allowing adversaries to operate undetected across sensitive environments. Custom backdoors like TinyRCT are specifically designed to evade signature-based defenses, making behavioral detection and robust network visibility essential. The targeting of critical infrastructure raises the stakes considerably, as successful espionage operations can inform future destructive attacks or provide geopolitical leverage to nation-state actors.