CL-STA-1062
CL-STA-1062 is a Chinese-speaking threat actor active since at least March 2022, conducting persistent operations across East Asia and, from mid-2025 onward, focusing on Southeast Asian government entities and state-owned critical energy infrastructure. Palo Alto Networks Unit 42 assessed with high confidence that CL-STA-1062 overlaps with Cisco Talos-tracked UAT-7237, which was previously linked to campaigns against web hosting infrastructure in Taiwan. Reported targeting includes government agencies, state-owned enterprises in the energy sector, and other critical infrastructure organizations in Southeast Asia, with the activity described as espionage. The actor uses a hybrid toolkit combining open-source and publicly available tools with custom malware. Observed tools include ASPX web shells for exploiting vulnerable web applications and establishing initial access, SoftEther VPN, VNT, Yuze, Mimikatz, and JuicyPotato. The group has disguised tooling as legitimate processes or software, including VMware executables and XDR agents, and has used password-protected RAR archives to stage tools and stolen data. Observed post-compromise activity includes reconnaissance, traceroute-based mapping for lateral movement opportunities, privilege escalation, persistent tunneling, MSSQL data theft, exfiltration of web server source code, and broader data exfiltration. A custom backdoor associated with the actor is TinyRCT, a previously undocumented lightweight C#/.NET backdoor also seen as PerfWatson2.exe. TinyRCT supports arbitrary command execution, file and directory enumeration, file exfiltration, screenshot capture, payload download, and self-deletion. It communicates over HTTP with hardcoded command-and-control infrastructure and uses AES-128-CBC encryption. Delivery observed in reporting used a malicious chrome_setup.zip archive containing a legitimate signed chrome_setup.exe, a malicious chrome_setup.exe.config file, and a rogue MyAppDomainManager.dll to abuse AppDomainManager injection, download the TinyRCT payload, and establish persistence via a scheduled task. Known alias: UAT-7237.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- Government & Administration
- Energy
Where they target
Geographies tied to known operations.
- 🇹🇼 Taiwan
Where they're from
Attributed origin per open-source reporting.
- CN
Tradecraft
35 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
3 malware families attributed to this actor across reporting.
Observables
19 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
7 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Persistent intrusion operations in East Asia, recently focused on government and critical energy infrastructure in Southeast Asia, involving breaches, data exfiltration, reconnaissance, persistence, and lateral movement preparation.
Persistent espionage-oriented intrusions across East Asia, with a later focus on Southeast Asian government entities and state-owned critical energy infrastructure. The group uses web shells, open-source post-exploitation tools, tunneling utilities, and the custom TinyRCT backdoor for persistence, reconnaissance, lateral movement, and data exfiltration.
Espionage-oriented intrusions targeting government entities, state-owned enterprises, and critical infrastructure in Southeast Asia and East Asia, using a hybrid toolkit of open-source utilities and the custom TinyRCT backdoor for reconnaissance, persistence, lateral movement, and data exfiltration.
Conducting sustained intrusions against government agencies and state-owned energy organizations in Southeast Asia using open-source tools and the custom TinyRCT backdoor, with activity including web shell deployment, credential theft, lateral movement, privilege escalation, and data exfiltration.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.