# CL-STA-1062 (UAT-7237) Deploys TinyRCT .NET Backdoor via AppDomainManager Injection Against Southeast Asian Government and Critical Energy Infrastructure

> Chinese-speaking APT cluster CL-STA-1062 (overlapping with Cisco Talos' UAT-7237) deployed a custom .NET backdoor named TinyRCT against at least ten government and critical-energy-infrastructure organizations across Southeast Asia between October and December 2025. TinyRCT is delivered via a trojanized chrome_setup.zip archive that abuses .NET AppDomainManager injection (T1574.014), then establishes AES-128-CBC-encrypted HTTP C2 supporting command execution, file exfiltration, and screen capture.

- **Published:** 2026-06-26T00:00:00Z
- **Last reviewed:** 2026-06-26T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0949
- **Card image:** https://intel.threadlinqs.com/og/threat/threat-intel-tinyrct-appdomainmanager-backdoor-tl-2026-0949.webp?v=a978ece8 (Threadlinqs threat intel: CL-STA-1062 TinyRCT .NET Backdoor: Detection & IOCs (TL-2026-0949) — High severity, 32 IOCs, 9 detection rules.)
- **ID:** TL-2026-0949
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Actor:** CL-STA-1062 (China)
- **Detections:** 9 (1 shown free below) · **IOCs:** 32 (3 shown free below)

## Description

Palo Alto Networks Unit 42 attributes (high confidence) an espionage campaign against Southeast Asian governments and state-owned critical energy infrastructure (CEI) to a Chinese-speaking activity cluster tracked as CL-STA-1062, which overlaps with the UAT-7237 group documented by Cisco Talos in August 2025. The actor has been active since at least March 2022, historically targeting East Asia (including Taiwanese web-hosting providers) and shifting through 2025 toward Southeast Asian government and energy-sector state-owned enterprises. Between October and December 2025 the actor likely compromised at least ten separate organizations in the region.

Initial access is achieved by exploiting public-facing web applications to drop ASPX web shells, which are used for reconnaissance via curl requests to actor-controlled infrastructure and to stage further tooling. In a September 2025 intrusion the actor deployed web shells, pulled records from an internal MSSQL server, and then scanned a neighbouring government entity for lateral-movement opportunities. The intrusion set blends open-source utilities — fscan (network scanning), JuicyPotato (privilege escalation), Mimikatz (credential theft), SoftEther VPN and the VNT tunnelling tool (disguised as vmtools.exe / VMware binaries), and the Yuze SOCKS5 proxy — with the custom TinyRCT backdoor, and exfiltrates findings inside password-protected RAR archives.

TinyRCT (deployed as PerfWatson2.exe, masquerading as a Microsoft Visual Studio telemetry process) is a lightweight C#/.NET remote access trojan. It is delivered as chrome_setup.zip, which bundles a legitimate signed executable, a malicious chrome_setup.exe.config file, and a rogue MyAppDomainManager.dll. When the legitimate executable runs, the .NET runtime reads the adjacent config and is forced to load MyAppDomainManager.dll (AppDomainManager injection, T1574.014). That DLL acts as a stealthy downloader: it validates it is running from %USERPROFILE%\Downloads, contacts the staging server 139.180.134[.]221, retrieves the PerfWatson2.exe payload into %LOCALAPPDATA%, and establishes persistence via a scheduled task named to mimic Google Updater (GoogleUpdaterTaskSystem140.0.7272.0) configured with highest privileges and an onlogon trigger.

TinyRCT beacons to C2 server 45.32.113[.]172 over standard HTTP using GET requests for command polling and POST requests for exfiltration, with a default 10-second sleep interval. All traffic is encrypted with AES-128 in CBC mode using a hard-coded key ("ThisIsASecretKey87654321") and a null IV. Capabilities include arbitrary command execution via cmd.exe, file/directory enumeration (Filename*Date*Size format), text-file reading, file download from URLs, binary exfiltration in 40 KB chunks, JPEG screenshot capture (compressed and encrypted), runtime reconfiguration of the sleep interval, sandbox-evasion checks, and a self-destruct routine that deletes its GoogleUpdater scheduled task and uses choice.exe for a three-second delay before deleting PerfWatson2.exe. All four observed servers (45.32.113[.]172, 139.180.134[.]221, 202.182.102[.]5, 45.76.210[.]43) reside in Vultr/Choopa (AS20473) address space.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1505.003 Web Shell
- T1059.003 Windows Command Shell
- T1053.005 Scheduled Task
- T1574.014 AppDomainManager
- T1036.005 Match Legitimate Resource Name or Location
- T1027 Obfuscated Files or Information
- T1497 Virtualization/Sandbox Evasion
- T1070.004 File Deletion
- T1070.009 Clear Persistence
- T1068 Exploitation for Privilege Escalation
- T1003.001 LSASS Memory
- T1046 Network Service Discovery
- T1018 Remote System Discovery
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1021.001 Remote Desktop Protocol
- T1113 Screen Capture
- T1005 Data from Local System
- T1560.001 Archive via Utility
- T1071.001 Web Protocols
- T1573.001 Symmetric Cryptography
- T1105 Ingress Tool Transfer
- T1090 Proxy
- T1572 Protocol Tunneling
- T1041 Exfiltration Over C2 Channel

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**TinyRCT HTTP C2 Beacon and Staging Tool-Transfer to Vultr/Choopa Infrastructure — C2 / Ingress** (`TL-2026-0949-SPL-003`)

Detects TinyRCT command-and-control and staging activity in proxy/web logs: regular HTTP GET polling and POST exfiltration to the known C2/staging IPs (45.32.113.172, 139.180.134.221, 202.182.102.5, 45.76.210.43 — all AS20473 Vultr/Choopa), and ingress tool-transfer URIs (/PerfWatson2.exe, /sdksdk608/). Maps to web-protocol C2 (T1071.001), ingress tool transfer (T1105) and exfiltration over C2 (T1041).

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1071.001, T1105, T1041
- **Data sources:** proxy, palo_alto_firewall, zeek_http, microsoft_defender_for_endpoint
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
index=proxy OR sourcetype="pan:traffic" OR sourcetype=stream:http
| eval dest=coalesce(dest_ip,dest)
| eval url=coalesce(url,uri_path,c_uri)
| search (dest="45.32.113.172" OR dest="139.180.134.221" OR dest="202.182.102.5" OR dest="45.76.210.43") OR url="*PerfWatson2.exe*" OR url="*/sdksdk608/*"
| stats count earliest(_time) as firstTime latest(_time) as lastTime dc(url) as unique_uris values(http_method) as methods values(url) as uris by src_ip dest
| eval reason="TinyRCT C2 / staging traffic to AS20473 (Vultr/Choopa) infrastructure (T1071.001/T1105/T1041)"
| convert ctime(firstTime) ctime(lastTime)
| table firstTime lastTime src_ip dest methods count unique_uris uris reason
```

### Microsoft KQL

```kql
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemoteIP in ("45.32.113.172", "139.180.134.221", "202.182.102.5", "45.76.210.43")
    or RemoteUrl has "/PerfWatson2.exe" or RemoteUrl has "/sdksdk608/"
| summarize ConnCount=count(), FirstSeen=min(Timestamp), LastSeen=max(Timestamp), Urls=make_set(RemoteUrl, 20) by DeviceName, InitiatingProcessFileName, RemoteIP, RemotePort
| extend Detection = "TinyRCT C2/staging traffic to Vultr/Choopa (AS20473)"
| order by LastSeen desc
```

### Sigma

```yaml
title: TinyRCT C2 Beacon and Staging Tool-Transfer to Vultr/Choopa Infrastructure
id: 7b1f0a2c-9d34-4c1e-9c41-0a4e8f7c1d03
status: experimental
description: Detects HTTP C2 and ingress tool-transfer to known TinyRCT (CL-STA-1062) IPs on AS20473 or to its staging URIs (/PerfWatson2.exe, /sdksdk608/).
references:
    - https://unit42.paloaltonetworks.com/cl-sta-1062-tinyrct-backdoor/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-06-26
tags:
    - attack.command_and_control
    - attack.t1071.001
    - attack.t1105
    - attack.t1041
logsource:
    category: proxy
detection:
    selection_ip:
        dst_ip:
            - '45.32.113.172'
            - '139.180.134.221'
            - '202.182.102.5'
            - '45.76.210.43'
    selection_uri:
        c-uri|contains:
            - '/PerfWatson2.exe'
            - '/sdksdk608/'
    condition: selection_ip or selection_uri
falsepositives:
    - Unrelated benign services later hosted on the same Vultr/Choopa IPs after takedown (verify timeframe)
level: high
```

**Known false positives:**

- Benign content later rehosted on the same Vultr/Choopa IPs after sinkholing/takedown — confirm the activity window matches the campaign timeline

**Tuning notes:** Pair the IOC IPs with a behavioral overlay: GET polling at a near-constant ~10s interval followed by POST bodies fragmented into ~40 KB chunks. Refresh the IP list against the latest Unit 42 IOC feed and expire IOCs after takedown to limit drift.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- TinyRCT .NET AppDomainManager Module Load From Downloads/LOCALAPPDATA — Exploitation (locked: unlock with TL Creds)
- TinyRCT Toolkit Credential Theft and Privilege Escalation — Mimikatz / JuicyPotato / fscan — Post-Exploitation (locked: unlock with TL Creds)
- TinyRCT Encrypted Beacon Cadence + RDP Lateral Movement — C2 / Lateral Movement (locked: unlock with TL Creds)
- TinyRCT Web Shell Drop and Recon on Public-Facing Server — Exploitation / Initial Access (locked: unlock with TL Creds)
- TinyRCT Self-Destruct — Scheduled-Task Deletion + [indicator] Delay + Payload Removal — Indicator Removal (locked: unlock with TL Creds)
- TinyRCT Chunked Exfiltration and SOCKS5/VPN Tunneling — Exfiltration / Proxy (locked: unlock with TL Creds)
- TinyRCT AppDomainManager Injection via Malicious .NET Config in Downloads — Exploitation (locked: unlock with TL Creds)
- TinyRCT GoogleUpdater Masquerade Scheduled Task + PerfWatson2 Outside Visual Studio — Post-Exploitation (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 32)

Defanged, TLP:CLEAR.

- IP address: `45.32.113[.]172`
- File hash: `00e09754526d0fe836ba27e3144ae161b0ecd3774abec5560504a16a67f0087c`
- IP address: `139.180.134[.]221`

Full set of 32 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [CL-STA-1062 Targets Southeast Asian Governments and Critical Infrastructure](https://unit42.paloaltonetworks.com/cl-sta-1062-tinyrct-backdoor/)
- [Chinese-Speaking APT Deploys New TinyRCT Backdoor in Southeast Asia Campaign](https://thehackernews.com/2026/06/chinese-speaking-apt-deploys-new.html)
- [China-Linked Hackers Strike Asian Critical Infrastructure with TinyRCT Backdoor](https://www.infosecurity-magazine.com/news/china-hackers-asian-cni-backdoor/)
- [CL-STA-1062 Hackers Use TinyRCT Backdoor to Target Southeast Asian Governments](https://cybersecuritynews.com/cl-sta-1062-hackers-use-tinyrct-backdoor/)
- [Chinese-Speaking Hackers Deploy TinyRCT Backdoor Against Critical Energy Infrastructure](https://gbhackers.com/tinyrct-backdoor-deployed/)
- [UAT-7237 targets Taiwanese web hosting infrastructure](https://blog.talosintelligence.com/uat-7237-targets-web-hosting-infra/)
- [Taiwan Web Servers Breached by UAT-7237 Using Customized Open-Source Hacking Tools](https://thehackernews.com/2025/08/taiwan-web-servers-breached-by-uat-7237.html)
- [MITRE ATT&CK T1574.014 Hijack Execution Flow: AppDomainManager](https://attack.mitre.org/techniques/T1574/014/)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0949