[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fTKvjdhtCvG6xhJuHfyGhbVvV9_-5FHY5dfZodjGRzVU":3},{"article":4,"iocs":45,"watch_terms":63,"solutions":64,"lesson":164},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":27,"category":28,"article_tags":32},"95356f4d-ab31-4bc4-8120-2c2aed34d242","Chinese-Speaking APT Deploys New TinyRCT Backdoor in Southeast Asia Campaign","chinese-speaking-apt-deploys-new-tinyrct-backdoor-in-southeast-asia-campaign-5a7767","A Chinese-speaking advanced persistent threat (APT) actor has been linked to a new custom backdoor called TinyRCT as part of cyber attacks aimed at government entities and critical infrastructure in Southeast Asia. The activity, particularly aimed at state-owned enterprises in the energy and government sectors, has been attributed to a threat actor called CL-STA-1062, which Palo Alto Networks","A Chinese-speaking APT group, identified as CL-STA-1062, is actively targeting government entities and critical infrastructure in Southeast Asia using a new custom backdoor named TinyRCT. This group, which shows overlaps with UAT-7237, has been observed conducting cyber espionage activities since at least March 2022, with recent campaigns in late 2025 focusing on data exfiltration and network reconnaissance.","Chinese APT CL-STA-1062 targets Southeast Asia with new TinyRCT backdoor.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F06\u002Fchinese-speaking-apt-deploys-new.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEgHsYcZgd4WIkN0k-b4_j7JxBgi0R0dzj0jSwSWVgItyIy88VoZK5z8BAiwjmYnou7YLrNuckCgQvnHXV2KYHoNS8WRZbjU1MP5HqvLKkIakvRVuJio7oZeUbi1XsgQVmJ-cDKKWeOzgGouUAzUtJrFRu8CtPQJG-eXCy7aSOx_fyCvGK2tRl12tBbPG7YC\u002Fs1600\u002Ftinyrct.jpg","2026-06-26T16:21:25+00:00","2026-06-26T18:00:28.480148+00:00",9,[17,20,22,25],{"name":18,"type":19},"CL-STA-1062","threat_actor",{"name":21,"type":19},"UAT-7237",{"name":23,"type":24},"Palo Alto Networks","vendor",{"name":26,"type":24},"Cisco Talos","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":27,"icon":29,"name":30,"slug":31},null,"Nation-state","nation-state",[33,35,40],{"category":34},{"id":27,"icon":29,"name":30,"slug":31},{"category":36},{"id":37,"icon":29,"name":38,"slug":39},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":41},{"id":42,"icon":29,"name":43,"slug":44},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[46,50,53,56,59],{"type":47,"value":48,"context":49},"ip","45.32.113[.]172","C2 server for TinyRCT backdoor",{"type":47,"value":51,"context":52},"139.180.134[.]221","Server for downloading TinyRCT executable",{"type":39,"value":54,"context":55},"TinyRCT","New custom backdoor deployed by CL-STA-1062",{"type":39,"value":57,"context":58},"PerfWatson2.exe","Filename for TinyRCT executable",{"type":60,"value":61,"context":62},"mitre_attack","T1059.005","AppDomainManager injection attack",[23,26],{"controls":65,"vendors":153},[66,95,124],{"slug":67,"name":68,"problem":69,"products":70},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[71,79,87],{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"slug":96,"name":97,"problem":98,"products":99},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[100,108,116],{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":117,"vendor_name":118,"vendor_logo":119,"product_slug":120,"product_name":121,"url":122,"description":123},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"slug":125,"name":126,"problem":127,"products":128},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[129,137,145],{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":133,"product_name":134,"url":135,"description":136},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":138,"vendor_name":139,"vendor_logo":140,"product_slug":141,"product_name":142,"url":143,"description":144},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",{"vendor_slug":146,"vendor_name":147,"vendor_logo":148,"product_slug":149,"product_name":150,"url":151,"description":152},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",[154,160],{"slug":155,"name":156,"logo_path":157,"roles":158},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png",[159],"reported_by",{"slug":161,"name":23,"logo_path":162,"roles":163},"palo-alto-networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png",[159],{"slug":165,"title":166,"body":167,"framework_refs":168,"framework_notes":182},"chinese-apt-deploys-tinyrct-backdoor-against-southeast-asian-government-targets","Chinese APT Deploys TinyRCT Backdoor Against Southeast Asian Government Targets","The CL-STA-1062 threat group has been conducting sustained cyber espionage against government entities and critical infrastructure in Southeast Asia since at least March 2022, leveraging a custom backdoor (TinyRCT) to enable stealthy data exfiltration and network reconnaissance. The multi-year dwell time suggests significant failures in threat detection and anomalous network traffic monitoring, allowing adversaries to operate undetected across sensitive environments. Custom backdoors like TinyRCT are specifically designed to evade signature-based defenses, making behavioral detection and robust network visibility essential. The targeting of critical infrastructure raises the stakes considerably, as successful espionage operations can inform future destructive attacks or provide geopolitical leverage to nation-state actors.",[169,170,171,172,173,174,175,176,177,178,179,180,181],"NIST SP 800-53 SI-3 (Malicious Code Protection)","NIST SP 800-53 AC-4 (Information Flow Enforcement)","NIST SP 800-53 AU-6 (Audit Record Review)","NIST SP 800-53 IR-4 (Incident Handling)","NIST SP 800-53 SC-7 (Boundary Protection)","CIS Control 13 (Network Monitoring and Defense)","CIS Control 16 (Application Software Security)","CIS Control 17 (Incident Response Management)","MITRE ATT&CK TA0010 (Exfiltration)","MITRE ATT&CK TA0007 (Discovery)","MITRE ATT&CK T1571 (Non-Standard Port)","ISO\u002FIEC 27001 A.16.1 (Management of Information Security Incidents)","ISO\u002FIEC 27001 A.13.1 (Network Security Management)",{}]