CL-STA-1062 (UAT-7237) Deploys TinyRCT .NET Backdoor via AppDomainManager Injection Against Southeast Asian Government and Critical Energy Infrastructure

CL-STA-1062 (UAT-7237) Deploys TinyRCT .NET Backdoor via (TL-2026-0949), also tracked as TinyRCT campaign, is a high-severity advanced persistent threat campaign, first published 2026-06-26. It is attributed to CL-STA-1062 (China) with high confidence, affects Microsoft Windows (.NET Framework AppDomainManager), maps to 26 MITRE ATT&CK techniques (T1003.001, T1005, T1018), and is covered by 9 detection rules and 32 indicators of compromise.

Key facts for TL-2026-0949

Threat ID
TL-2026-0949
Also known as
TinyRCT campaign, CL-STA-1062
Severity
HIGH
Status
ACTIVE
Category
APT
First published
2026-06-26
Last reviewed
2026-06-26
Attribution
CL-STA-1062
Attribution confidence
HIGH
Nation-state nexus
China
Motivation
ESPIONAGE
Target sectors
government, energy, critical-infrastructure, state-owned-enterprises
Target regions
Southeast Asia, East Asia
Detection rules
9
Indicators of compromise
32

Malware and tooling in CL-STA-1062 (UAT-7237) Deploys TinyRCT .NET Backdoor via

Malware and tooling: TinyRCT, JuicyPotato, Mimikatz, Yuze

Chinese-speaking APT cluster CL-STA-1062 (overlapping with Cisco Talos' UAT-7237) deployed a custom .NET backdoor named TinyRCT against at least ten government and critical-energy-infrastructure organizations across Southeast Asia between October and December 2025. TinyRCT is delivered via a trojanized chrome_setup.zip archive that abuses .NET AppDomainManager injection (T1574.014), then establishes AES-128-CBC-encrypted HTTP C2 supporting command execution, file exfiltration, and screen capture.

How CL-STA-1062 (UAT-7237) Deploys TinyRCT .NET Backdoor via works

Palo Alto Networks Unit 42 attributes (high confidence) an espionage campaign against Southeast Asian governments and state-owned critical energy infrastructure (CEI) to a Chinese-speaking activity cluster tracked as CL-STA-1062, which overlaps with the UAT-7237 group documented by Cisco Talos in August 2025. The actor has been active since at least March 2022, historically targeting East Asia (including Taiwanese web-hosting providers) and shifting through 2025 toward Southeast Asian government and energy-sector state-owned enterprises. Between October and December 2025 the actor likely compromised at least ten separate organizations in the region.

Initial access is achieved by exploiting public-facing web applications to drop ASPX web shells, which are used for reconnaissance via curl requests to actor-controlled infrastructure and to stage further tooling. In a September 2025 intrusion the actor deployed web shells, pulled records from an internal MSSQL server, and then scanned a neighbouring government entity for lateral-movement opportunities. The intrusion set blends open-source utilities — fscan (network scanning), JuicyPotato (privilege escalation), Mimikatz (credential theft), SoftEther VPN and the VNT tunnelling tool (disguised as vmtools.exe / VMware binaries), and the Yuze SOCKS5 proxy — with the custom TinyRCT backdoor, and exfiltrates findings inside password-protected RAR archives.

TinyRCT (deployed as PerfWatson2.exe, masquerading as a Microsoft Visual Studio telemetry process) is a lightweight C#/.NET remote access trojan. It is delivered as chrome_setup.zip, which bundles a legitimate signed executable, a malicious chrome_setup.exe.config file, and a rogue MyAppDomainManager.dll. When the legitimate executable runs, the .NET runtime reads the adjacent config and is forced to load MyAppDomainManager.dll (AppDomainManager injection, T1574.014). That DLL acts as a stealthy downloader: it validates it is running from %USERPROFILE%\Downloads, contacts the staging server 139.180.134[.]221, retrieves the PerfWatson2.exe payload into %LOCALAPPDATA%, and establishes persistence via a scheduled task named to mimic Google Updater (GoogleUpdaterTaskSystem140.0.7272.0) configured with highest privileges and an onlogon trigger.

TinyRCT beacons to C2 server 45.32.113[.]172 over standard HTTP using GET requests for command polling and POST requests for exfiltration, with a default 10-second sleep interval. All traffic is encrypted with AES-128 in CBC mode using a hard-coded key ("ThisIsASecretKey87654321") and a null IV. Capabilities include arbitrary command execution via cmd.exe, file/directory enumeration (Filename*Date*Size format), text-file reading, file download from URLs, binary exfiltration in 40 KB chunks, JPEG screenshot capture (compressed and encrypted), runtime reconfiguration of the sleep interval, sandbox-evasion checks, and a self-destruct routine that deletes its GoogleUpdater scheduled task and uses choice.exe for a three-second delay before deleting PerfWatson2.exe. All four observed servers (45.32.113[.]172, 139.180.134[.]221, 202.182.102[.]5, 45.76.210[.]43) reside in Vultr/Choopa (AS20473) address space.

MITRE ATT&CK techniques used in TL-2026-0949

Credential Access

T1003.001 LSASS Memory

Collection

T1005 Data from Local System; T1113 Screen Capture; T1560.001 Archive via Utility

Discovery

T1018 Remote System Discovery; T1046 Network Service Discovery; T1082 System Information Discovery; T1083 File and Directory Discovery

Lateral Movement

T1021.001 Remote Desktop Protocol

Defense Evasion

T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1070.004 File Deletion; T1070.009 Clear Persistence; T1497 Virtualization/Sandbox Evasion; T1574.014 AppDomainManager

Exfiltration

T1041 Exfiltration Over C2 Channel

Persistence

T1053.005 Scheduled Task; T1505.003 Web Shell

Execution

T1059.003 Windows Command Shell

Privilege Escalation

T1068 Exploitation for Privilege Escalation

Command and Control

T1071.001 Web Protocols; T1090 Proxy; T1105 Ingress Tool Transfer; T1572 Protocol Tunneling; T1573.001 Symmetric Cryptography

Initial Access

T1190 Exploit Public-Facing Application

Affected products and versions in CL-STA-1062 (UAT-7237) Deploys TinyRCT .NET Backdoor via

  • Microsoft — Windows (.NET Framework AppDomainManager)
    Vulnerable versions: Windows hosts running .NET Framework applications

Remediation for CL-STA-1062 (UAT-7237) Deploys TinyRCT .NET Backdoor via

Patches

  • Patch internet-facing web applications and MSSQL servers exploited for initial access and lateral movement

Immediate actions

  • Block and alert on the C2/staging IPs 45.32.113.172, 139.180.134.221, 202.182.102.5 and 45.76.210.43 at the perimeter
  • Hunt for PerfWatson2.exe executing from %LOCALAPPDATA% rather than a Visual Studio install path
  • Hunt for scheduled tasks named GoogleUpdaterTaskSystem* with /rl highest and onlogon triggers not created by a genuine Google Updater
  • Search for chrome_setup.zip, chrome_setup.exe.config and MyAppDomainManager.dll on disk and in download folders
  • Inspect public-facing web servers for unauthorized ASPX web shells

Workarounds

  • Disable or tightly restrict .NET AppDomainManager override via configuration policy where feasible
  • Remove unused VPN/tunnelling software (SoftEther) and block its installation

Longer-term hardening

  • Deploy EDR with behavioral detection for AppDomainManager injection (T1574.014) and unsigned DLLs loaded via .NET config files
  • Restrict and monitor outbound HTTP from servers and workstations to hosting-provider IP ranges (e.g. Vultr/Choopa)
  • Enforce application allowlisting to block execution of binaries masquerading as vmtools.exe / VMware processes
  • Segment OT/CEI networks from IT and government enclaves to limit lateral movement
  • Enable LSASS protection (Credential Guard / RunAsPPL) to blunt Mimikatz credential theft

Weaknesses (CWE) in CL-STA-1062 (UAT-7237) Deploys TinyRCT .NET Backdoor via

CWE-94, CWE-829

Timeline of CL-STA-1062 (UAT-7237) Deploys TinyRCT .NET Backdoor via

  • Earliest CL-STA-1062 / UAT-7237 activity observed by Unit 42, historically targeting East Asia.
  • Through mid-2025 CL-STA-1062 shifts focus toward critical infrastructure, initiating vulnerability scanning across multiple Southeast Asian regional entities (Unit 42).
  • Cisco Talos publicly documents UAT-7237 (overlapping CL-STA-1062) targeting Taiwanese web-hosting infrastructure with SoftEther VPN, SoundBill loader, Mimikatz and Cobalt Strike.
  • Actor compromises a Southeast Asian government entity, deploys ASPX web shells, and exfiltrates records from an internal MSSQL server.
  • During the September intrusion the actor conducts reconnaissance and scanning against a separate/neighbouring Southeast Asian government target for lateral-movement opportunities.
  • Start of the wave in which at least ten Southeast Asian government and critical-energy-infrastructure organizations are likely compromised, with TinyRCT deployed.
  • Continued compromises through December 2025; TinyRCT delivered via chrome_setup.zip using AppDomainManager injection and AES-128-CBC HTTP C2 to 45.32.113.172.
  • Palo Alto Networks Unit 42 publishes the CL-STA-1062 TinyRCT report with full IOCs and attribution at high confidence.

Sources cited for CL-STA-1062 (UAT-7237) Deploys TinyRCT .NET Backdoor via

Threats related to CL-STA-1062 (UAT-7237) Deploys TinyRCT .NET Backdoor via

Detection coverage for TL-2026-0949

As of 2026-06-26, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0949 across Splunk SPL, Microsoft KQL and Sigma, covering 32 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats