TinyRCT Backdoor Puts Southeast Asian Government and Energy Networks on Alert

A Chinese-speaking advanced persistent threat cluster has been tied to a custom .NET backdoor called TinyRCT in cyberattacks aimed at government entities and critical infrastructure across Southeast Asia.

The activity is tracked as CL-STA-1062 and has been associated with operations against state-owned enterprises, energy organizations, and government-sector targets. Palo Alto Networks Unit 42 has also described overlaps with UAT-7237, a group Cisco Talos previously connected to attacks on web infrastructure entities in Taiwan.

The important detail for defenders is not only the new malware. CL-STA-1062 appears to be mixing a bespoke backdoor with familiar open-source and dual-use tools, including SoftEther VPN, Mimikatz, VNT, and Yuze. That combination gives the group a practical playbook: get in through exposed web infrastructure, establish access with web shells, move laterally with commodity tools, and reserve custom malware for capabilities that are harder to get from off-the-shelf utilities.

What TinyRCT Does

TinyRCT is described as a lightweight remote access trojan built on .NET. Once running, it can support several actions that matter in an intrusion response:

• Run arbitrary commands on the compromised system.
• Enumerate files and exfiltrate selected data.
• Upload files to the infected host.
• Capture screenshots from the device.
• Perform system reconnaissance.
• Remove itself from the host to reduce traces.

The malware communicates with its command-and-control server over HTTP and encrypts exchanged data with AES-128 in CBC mode. It uses a beaconing model, polling for instructions with GET requests and sending stolen data back through POST requests. The default sleep interval described for the malware is 10 seconds, which gives defenders a network pattern to look for when reviewing suspicious outbound HTTP traffic.

TinyRCT also includes checks intended to avoid execution in sandboxed environments. That does not make it unusually advanced by itself, but it does show the operators are thinking about analysis resistance and not simply relying on public tooling.

How the Campaign Appears to Work

Since at least mid-2025, CL-STA-1062 activity has focused on critical infrastructure targets in Southeast Asia. The group has been described as scanning regional entities for vulnerabilities, then using ASPX web shells to gain an initial foothold and perform reconnaissance from inside compromised networks.

From there, the operators deploy additional payloads and tools. The observed toolkit includes SoftEther VPN components, RAR archives, Yuze as a SOCKS5 proxy, and VNT as a VPN utility. In some cases, those tools were disguised with names that mimic VMware executables or security software, including examples such as XDRAgent.exe, vmtools.exe, and vmwared.exe.

One September 2025 incident was described as involving a Southeast Asian government entity where attackers allegedly deployed a web shell and used it to exfiltrate data from an MS SQL server. That specific intrusion detail has not been independently verified, so it should be treated as an attributed case description rather than a confirmed public finding.

During the same activity, the operators were also said to have conducted network reconnaissance against another government entity in the same country, suggesting possible interest in broader access or lateral movement paths. That detail has likewise not been independently verified. Unit 42 also described at least one case involving staged and exfiltrated web server source code, along with breaches affecting at least 10 organizations in Southeast Asia between October and December 2025; those figures should be handled as attributed findings, not independently confirmed public counts.

How TinyRCT Is Delivered

TinyRCT has been associated with a malicious archive named chrome_setup.zip. The archive contains three components:

• A legitimate executable named chrome_setup.exe.
• A configuration file named chrome_setup.exe.config.
• A malicious DLL named MyAppDomainManager.dll.

The rogue DLL is used in an AppDomainManager injection technique. In the described chain, the DLL acts as a downloader and retrieves the TinyRCT payload, identified as PerfWatson2.exe.

That naming is worth attention. PerfWatson is associated with Microsoft Visual Studio telemetry components, so a file named PerfWatson2.exe can look ordinary during a quick process or filesystem review. The same logic applies to the group’s use of VMware-like filenames and XDR-themed names for other tools. The campaign is not hiding behind one perfect disguise; it is leaning on plausible administrative clutter.

What Security Teams Should Check First

Organizations in government, energy, telecom, and other infrastructure-heavy sectors in Southeast Asia should treat this activity as a web-infrastructure and lateral-movement problem, not only as a malware-detection problem. TinyRCT matters, but the surrounding behavior may be easier to catch.

A practical first pass should include:

1. Review externally exposed web servers for unfamiliar ASPX web shells, recent file writes, and suspicious child processes spawned by web services.
2. Search endpoints and servers for the filenames chrome_setup.zip, chrome_setup.exe.config, MyAppDomainManager.dll, PerfWatson2.exe, XDRAgent.exe, vmtools.exe, and vmwared.exe where they do not belong.
3. Audit unexpected SoftEther VPN, VNT, Yuze, RAR, and Mimikatz presence, especially on servers that do not normally require those tools.
4. Inspect outbound HTTP traffic for short-interval beaconing behavior and repeated GET and POST patterns to unfamiliar infrastructure.
5. Review SQL Server access logs and web server directories for signs of staged data, compressed archives, or source-code collection.
6. Check whether administrative tools are being launched from unusual directories, temporary folders, web roots, or service accounts.

The most useful detections will likely combine file, process, and network signals. A standalone alert on SoftEther or RAR may be noisy in some environments. The same tool appearing after a web shell write, under a web service account, with outbound traffic to unfamiliar infrastructure is a much stronger signal.

Why the Tool Mix Matters

CL-STA-1062’s approach is pragmatic. Open-source tools help with access, tunneling, credential theft, and lateral movement. TinyRCT adds a custom backdoor for command execution, file operations, screenshots, and cleanup. That blend makes the campaign harder to reduce to a single indicator of compromise.

For buyers and security leaders, the takeaway is straightforward: this is the kind of activity that tests whether visibility is connected across web servers, endpoints, identity, and network egress. Endpoint detection alone may miss the early web shell. Network monitoring alone may not explain why a server is suddenly talking out every 10 seconds. Vulnerability management alone will not show what happened after the foothold was established.

The campaign also reinforces a familiar problem in critical infrastructure environments: attackers do not need exotic malware at every step. A small custom implant, a handful of public tools, and patient reconnaissance can be enough when exposed web services and flat internal access give them room to move.