TinyRCT Backdoor Gives CL-STA-1062 Command Execution and File Exfiltration Capabilities

Throughout 2025, a highly active Chinese-speaking threat actor tracked as CL-STA-1062 systematically targeted government entities and critical energy infrastructure across Southeast Asia. Previously identified by Cisco Talos as UAT-7237 during mid-2025 attacks on Taiwanese web hosting infrastructure, this group has significantly expanded its regional focus. Recent investigations into the group’s long-term operations reveal a transition from relying solely on open-source…