Loading threat actor…
CL-STA-1062 is a Chinese-speaking, China-linked espionage threat actor active since at least March 2022. The group has conducted sustained operations across East Asia and, from mid-2025 onward, shifted significant focus to Southeast Asian government entities and state-owned critical infrastructure, especially energy providers. High-confidence reporting links CL-STA-1062 to the activity cluster previously tracked as UAT-7237, which was associated with campaigns against web-hosting infrastructure in Taiwan. The actor’s operations are characterized by web-application exploitation and deployment of ASPX web shells for initial access, followed by reconnaissance, credential theft, privilege escalation, persistence, lateral movement, and data exfiltration. Observed post-compromise activity includes theft of database contents and web server source code, staging of stolen data in password-protected archives, and pivoting between related government entities within the same country. The group has also conducted vulnerability scanning against additional critical infrastructure targets. CL-STA-1062 uses a hybrid toolkit that combines open-source utilities with bespoke malware. Publicly reported tooling includes SoftEther VPN and other tunneling utilities for covert connectivity and network traversal, Mimikatz for credential harvesting, JuicyPotato for privilege escalation, and a custom C# backdoor known as TinyRCT. TinyRCT provides remote command execution, system fingerprinting, file enumeration and exfiltration, screenshot capture, encrypted command-and-control communications, persistence support, anti-analysis checks, and a self-destruct capability intended to remove forensic evidence. Delivery has been observed through DLL side-loading and AppDomainManager injection chains disguised as legitimate software installers. The targeting profile, operational persistence, regional focus, and emphasis on intelligence collection against government and critical infrastructure strongly indicate an espionage mission. Known aliases include UAT-7237.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
35 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
3 malware families attributed to this actor across reporting.
19 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
9 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
China-linked espionage or possible initial-access activity targeting Southeast Asian critical infrastructure, government, and military organizations, using a novel backdoor and lateral movement across linked entities.
Persistent intrusion operations in East Asia, recently focused on government and critical energy infrastructure in Southeast Asia, involving breaches, data exfiltration, reconnaissance, persistence, and lateral movement preparation.
Persistent espionage-oriented intrusions across East Asia, with a later focus on Southeast Asian government entities and state-owned critical energy infrastructure. The group uses web shells, open-source post-exploitation tools, tunneling utilities, and the custom TinyRCT backdoor for persistence, reconnaissance, lateral movement, and data exfiltration.
Espionage-oriented intrusions targeting government entities, state-owned enterprises, and critical infrastructure in Southeast Asia and East Asia, using a hybrid toolkit of open-source utilities and the custom TinyRCT backdoor for reconnaissance, persistence, lateral movement, and data exfiltration.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.