CL-STA-1062 (UAT-7237) Deploys TinyRCT .NET Backdoor via AppDomainManager Injection Against Southeast Asian Government and Critical Energy Infrastructure

Key facts for TinyRCT AppDomainManager backdoor

Detection coverage for TinyRCT AppDomainManager backdoor

As of 2026-06-26, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0949 across Splunk SPL, Microsoft KQL and Sigma, covering 32 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: TinyRCT HTTP C2 Beacon and Staging Tool-Transfer to Vultr/Choopa Infrastructure — C2 / Ingress

Detects TinyRCT command-and-control and staging activity in proxy/web logs: regular HTTP GET polling and POST exfiltration to the known C2/staging IPs (45.32.113.172, 139.180.134.221, 202.182.102.5, 45.76.210.43 — all AS20473 Vultr/Choopa), and ingress tool-transfer URIs (/PerfWatson2.exe, /sdksdk608/). Maps to web-protocol C2 (T1071.001), ingress tool transfer (T1105) and exfiltration over C2 (T1041).

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1071.001, T1105, T1041
• Data sources: proxy, palo_alto_firewall, zeek_http, microsoft_defender_for_endpoint
• Severity: critical
• Confidence: high

Splunk SPL

index=proxy OR sourcetype="pan:traffic" OR sourcetype=stream:http
| eval dest=coalesce(dest_ip,dest)
| eval url=coalesce(url,uri_path,c_uri)
| search (dest="45.32.113.172" OR dest="139.180.134.221" OR dest="202.182.102.5" OR dest="45.76.210.43") OR url="*PerfWatson2.exe*" OR url="*/sdksdk608/*"
| stats count earliest(_time) as firstTime latest(_time) as lastTime dc(url) as unique_uris values(http_method) as methods values(url) as uris by src_ip dest
| eval reason="TinyRCT C2 / staging traffic to AS20473 (Vultr/Choopa) infrastructure (T1071.001/T1105/T1041)"
| convert ctime(firstTime) ctime(lastTime)
| table firstTime lastTime src_ip dest methods count unique_uris uris reason

Microsoft KQL

DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemoteIP in ("45.32.113.172", "139.180.134.221", "202.182.102.5", "45.76.210.43")
    or RemoteUrl has "/PerfWatson2.exe" or RemoteUrl has "/sdksdk608/"
| summarize ConnCount=count(), FirstSeen=min(Timestamp), LastSeen=max(Timestamp), Urls=make_set(RemoteUrl, 20) by DeviceName, InitiatingProcessFileName, RemoteIP, RemotePort
| extend Detection = "TinyRCT C2/staging traffic to Vultr/Choopa (AS20473)"
| order by LastSeen desc

Sigma

title: TinyRCT C2 Beacon and Staging Tool-Transfer to Vultr/Choopa Infrastructure
id: 7b1f0a2c-9d34-4c1e-9c41-0a4e8f7c1d03
status: experimental
description: Detects HTTP C2 and ingress tool-transfer to known TinyRCT (CL-STA-1062) IPs on AS20473 or to its staging URIs (/PerfWatson2.exe, /sdksdk608/).
references:
    - https://unit42.paloaltonetworks.com/cl-sta-1062-tinyrct-backdoor/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-06-26
tags:
    - attack.command_and_control
    - attack.t1071.001
    - attack.t1105
    - attack.t1041
logsource:
    category: proxy
detection:
    selection_ip:
        dst_ip:
            - '45.32.113.172'
            - '139.180.134.221'
            - '202.182.102.5'
            - '45.76.210.43'
    selection_uri:
        c-uri|contains:
            - '/PerfWatson2.exe'
            - '/sdksdk608/'
    condition: selection_ip or selection_uri
falsepositives:
    - Unrelated benign services later hosted on the same Vultr/Choopa IPs after takedown (verify timeframe)
level: high

Known false positives:

• Benign content later rehosted on the same Vultr/Choopa IPs after sinkholing/takedown — confirm the activity window matches the campaign timeline

Tuning notes: Pair the IOC IPs with a behavioral overlay: GET polling at a near-constant ~10s interval followed by POST bodies fragmented into ~40 KB chunks. Refresh the IP list against the latest Unit 42 IOC feed and expire IOCs after takedown to limit drift.

• 🔒 TinyRCT .NET AppDomainManager Module Load From Downloads/LOCALAPPDATA — Exploitation · unlock with TL Creds
• 🔒 TinyRCT Toolkit Credential Theft and Privilege Escalation — Mimikatz / JuicyPotato / fscan — Post-Exploitation · unlock with TL Creds
• 🔒 TinyRCT Encrypted Beacon Cadence + RDP Lateral Movement — C2 / Lateral Movement · unlock with TL Creds
• 🔒 TinyRCT Web Shell Drop and Recon on Public-Facing Server — Exploitation / Initial Access · unlock with TL Creds
• 🔒 TinyRCT Self-Destruct — Scheduled-Task Deletion + [indicator] Delay + Payload Removal — Indicator Removal · unlock with TL Creds
• 🔒 TinyRCT Chunked Exfiltration and SOCKS5/VPN Tunneling — Exfiltration / Proxy · unlock with TL Creds
• 🔒 TinyRCT AppDomainManager Injection via Malicious .NET Config in Downloads — Exploitation · unlock with TL Creds
• 🔒 TinyRCT GoogleUpdater Masquerade Scheduled Task + PerfWatson2 Outside Visual Studio — Post-Exploitation · unlock with TL Creds

Indicators of compromise for TinyRCT AppDomainManager backdoor

As of 2026-06-26, Threadlinqs Intelligence tracks 32 indicators of compromise for TL-2026-0949.

Sample indicators (3 of 32)

• IP address: 45.32.113[.]172
• File hash: 00e09754526d0fe836ba27e3144ae161b0ecd3774abec5560504a16a67f0087c
• IP address: 139.180.134[.]221

Defanged, TLP:CLEAR. Full set of 32 indicators: unlock with TL Creds.

How TinyRCT AppDomainManager backdoor works

Palo Alto Networks Unit 42 attributes (high confidence) an espionage campaign against Southeast Asian governments and state-owned critical energy infrastructure (CEI) to a Chinese-speaking activity cluster tracked as CL-STA-1062, which overlaps with the UAT-7237 group documented by Cisco Talos in August 2025. The actor has been active since at least March 2022, historically targeting East Asia (including Taiwanese web-hosting providers) and shifting through 2025 toward Southeast Asian government and energy-sector state-owned enterprises. Between October and December 2025 the actor likely compromised at least ten separate organizations in the region.

Initial access is achieved by exploiting public-facing web applications to drop ASPX web shells, which are used for reconnaissance via curl requests to actor-controlled infrastructure and to stage further tooling. In a September 2025 intrusion the actor deployed web shells, pulled records from an internal MSSQL server, and then scanned a neighbouring government entity for lateral-movement opportunities. The intrusion set blends open-source utilities — fscan (network scanning), JuicyPotato (privilege escalation), Mimikatz (credential theft), SoftEther VPN and the VNT tunnelling tool (disguised as vmtools.exe / VMware binaries), and the Yuze SOCKS5 proxy — with the custom TinyRCT backdoor, and exfiltrates findings inside password-protected RAR archives.

TinyRCT (deployed as PerfWatson2.exe, masquerading as a Microsoft Visual Studio telemetry process) is a lightweight C#/.NET remote access trojan. It is delivered as chrome_setup.zip, which bundles a legitimate signed executable, a malicious chrome_setup.exe.config file, and a rogue MyAppDomainManager.dll. When the legitimate executable runs, the .NET runtime reads the adjacent config and is forced to load MyAppDomainManager.dll (AppDomainManager injection, T1574.014). That DLL acts as a stealthy downloader: it validates it is running from %USERPROFILE%\Downloads, contacts the staging server 139.180.134[.]221, retrieves the PerfWatson2.exe payload into %LOCALAPPDATA%, and establishes persistence via a scheduled task named to mimic Google Updater (GoogleUpdaterTaskSystem140.0.7272.0) configured with highest privileges and an onlogon trigger.

TinyRCT beacons to C2 server 45.32.113[.]172 over standard HTTP using GET requests for command polling and POST requests for exfiltration, with a default 10-second sleep interval. All traffic is encrypted with AES-128 in CBC mode using a hard-coded key ("ThisIsASecretKey87654321") and a null IV. Capabilities include arbitrary command execution via cmd.exe, file/directory enumeration (Filename*Date*Size format), text-file reading, file download from URLs, binary exfiltration in 40 KB chunks, JPEG screenshot capture (compressed and encrypted), runtime reconfiguration of the sleep interval, sandbox-evasion checks, and a self-destruct routine that deletes its GoogleUpdater scheduled task and uses choice.exe for a three-second delay before deleting PerfWatson2.exe. All four observed servers (45.32.113[.]172, 139.180.134[.]221, 202.182.102[.]5, 45.76.210[.]43) reside in Vultr/Choopa (AS20473) address space.

MITRE ATT&CK techniques by tactic:

Credential Access

T1003.001 LSASS Memory

Collection

T1005 Data from Local System; T1113 Screen Capture; T1560.001 Archive via Utility

Discovery

T1018 Remote System Discovery; T1046 Network Service Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery

Lateral Movement

T1021.001 Remote Desktop Protocol

Defense Evasion

T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1070.004 File Deletion; T1070.009 Clear Persistence; T1497 Virtualization/Sandbox Evasion; T1574.014 AppDomainManager

Exfiltration

T1041 Exfiltration Over C2 Channel

Persistence

T1053.005 Scheduled Task; T1505.003 Web Shell

Execution

T1059.003 Windows Command Shell

Privilege Escalation

T1068 Exploitation for Privilege Escalation

Command and Control

T1071.001 Web Protocols; T1090 Proxy; T1105 Ingress Tool Transfer; T1572 Protocol Tunneling; T1573.001 Symmetric Cryptography

Initial Access

T1190 Exploit Public-Facing Application

Remediation for TinyRCT AppDomainManager backdoor

Patches

• Patch internet-facing web applications and MSSQL servers exploited for initial access and lateral movement

Immediate actions

• Block and alert on the C2/staging IPs 45.32.113.172, 139.180.134.221, 202.182.102.5 and 45.76.210.43 at the perimeter
• Hunt for PerfWatson2.exe executing from %LOCALAPPDATA% rather than a Visual Studio install path
• Hunt for scheduled tasks named GoogleUpdaterTaskSystem* with /rl highest and onlogon triggers not created by a genuine Google Updater
• Search for chrome_setup.zip, chrome_setup.exe.config and MyAppDomainManager.dll on disk and in download folders
• Inspect public-facing web servers for unauthorized ASPX web shells

Workarounds

• Disable or tightly restrict .NET AppDomainManager override via configuration policy where feasible
• Remove unused VPN/tunnelling software (SoftEther) and block its installation

Longer-term hardening

• Deploy EDR with behavioral detection for AppDomainManager injection (T1574.014) and unsigned DLLs loaded via .NET config files
• Restrict and monitor outbound HTTP from servers and workstations to hosting-provider IP ranges (e.g. Vultr/Choopa)
• Enforce application allowlisting to block execution of binaries masquerading as vmtools.exe / VMware processes
• Segment OT/CEI networks from IT and government enclaves to limit lateral movement
• Enable LSASS protection (Credential Guard / RunAsPPL) to blunt Mimikatz credential theft

Affected and fixed versions

• Microsoft — Windows (.NET Framework AppDomainManager)
  Vulnerable versions: Windows hosts running .NET Framework applications

Timeline of TinyRCT AppDomainManager backdoor

• 2022-03-01 Earliest CL-STA-1062 / UAT-7237 activity observed by Unit 42, historically targeting East Asia.
• 2025-07-01 Through mid-2025 CL-STA-1062 shifts focus toward critical infrastructure, initiating vulnerability scanning across multiple Southeast Asian regional entities (Unit 42).
• 2025-08-15 Cisco Talos publicly documents UAT-7237 (overlapping CL-STA-1062) targeting Taiwanese web-hosting infrastructure with SoftEther VPN, SoundBill loader, locked-ioc-30 and Cobalt Strike.
• 2025-09-01 Actor compromises a Southeast Asian government entity, deploys ASPX web shells, and exfiltrates records from an internal MSSQL server.
• 2025-09-15 During the September intrusion the actor conducts reconnaissance and scanning against a separate/neighbouring Southeast Asian government target for lateral-movement opportunities.
• 2025-10-01 Start of the wave in which at least ten Southeast Asian government and critical-energy-infrastructure organizations are likely compromised, with locked-ioc-31 deployed.
• 2025-12-01 Continued compromises through December 2025; locked-ioc-31 delivered via locked-ioc-19 using AppDomainManager injection and AES-128-CBC HTTP C2 to locked-ioc-22.
• 2026-06-26 Palo Alto Networks Unit 42 publishes the CL-STA-1062 locked-ioc-31 report with full IOCs and attribution at high confidence.

Sources cited for TinyRCT AppDomainManager backdoor

• CL-STA-1062 Targets Southeast Asian Governments and Critical Infrastructure Unit 42 · Vendor report · 2026-06-26
• UAT-7237 targets Taiwanese web hosting infrastructure Cisco Talos · Vendor report · 2025-08-15
• MITRE ATT&CK T1574.014 Hijack Execution Flow: AppDomainManager MITRE · Research · 2024-01-01
• Chinese-Speaking APT Deploys New TinyRCT Backdoor in Southeast Asia Campaign The Hacker News · News · 2026-06-26
• China-Linked Hackers Strike Asian Critical Infrastructure with TinyRCT Backdoor infosecurity-magazine.com · News · 2026-06-26
• CL-STA-1062 Hackers Use TinyRCT Backdoor to Target Southeast Asian Governments cybersecuritynews.com · News · 2026-06-26
• Chinese-Speaking Hackers Deploy TinyRCT Backdoor Against Critical Energy Infrastructure gbhackers.com · News · 2026-06-26
• Taiwan Web Servers Breached by UAT-7237 Using Customized Open-Source Hacking Tools The Hacker News · News · 2025-08-15

Threats related to TinyRCT AppDomainManager backdoor

• SHADOW-EARTH-053 — China-Aligned Cyberespionage Campaign Exploiting Microsoft Exchange (ProxyLogon CVE-2021-26855/26857/26858/27065) and IIS to Deploy GODZILLA Web Shells and ShadowPad

Related coverage of this activity

• SparrowDoor persistent loader

Previous and next in apt

• Nation-State Pre-Positioning Intrusion into Australian Critical Infrastructure (ASIO 2026 Threat Assessment Disclosure) Previous report
• Russian APT Gamaredon Upgrades Arsenal with Six New PowerShell Downloaders, Cloudflare/Devtunnel C2 Concealment, and Turla Collaboration Delivering Kazuar Backdoor (2025) Next report