China-Linked Hackers Strike Asian Critical Infrastructure with TinyRCT Backdoor

Infosecurity Magazine

June 26, 2026 at 10:30 AM

Actively Exploited

Overview

A group of hackers linked to China has been targeting critical infrastructure across Southeast Asia using a new backdoor known as TinyRCT. This custom malware is designed to infiltrate and compromise systems that are vital for national security and public services. While specific details about the affected sectors are limited, the implications of such attacks are severe, potentially disrupting essential services like electricity, water supply, and transportation. Researchers emphasize the need for heightened security measures in these sectors to mitigate risks. The ongoing nature of these attacks raises concerns about the vulnerability of infrastructure to foreign cyber threats, making it crucial for organizations to stay vigilant and proactive in their cybersecurity strategies.

Key Takeaways

Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
Affected Systems: Critical infrastructure systems in Southeast Asia
Action Required: Organizations should implement enhanced security protocols, conduct regular system audits, and ensure timely software updates to protect against similar threats.
Timeline: Newly disclosed

Original Article Summary

A China-linked threat group has been targeting critical infrastructure in Southeast Asia with a new custom backdoor called TinyRCT

Impact

Critical infrastructure systems in Southeast Asia

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Newly disclosed

Remediation

Organizations should implement enhanced security protocols, conduct regular system audits, and ensure timely software updates to protect against similar threats.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to Vulnerability, Malware, Critical.

Read Original Article

Related Coverage

Polymarket customers lose $3 million in supply-chain attack

BleepingComputer

Polymarket, an online prediction market platform, reported a significant security incident that resulted in approximately $3 million in losses for its customers. This breach occurred when attackers injected a malicious script into Polymarket's frontend, exploiting a vulnerability in a third-party vendor's systems. As a result, user accounts were compromised, leading to unauthorized access and theft of funds. Polymarket has stated that it will fully reimburse affected customers, which is a crucial step in maintaining trust with its user base. This incident emphasizes the risks associated with relying on third-party services and highlights the importance of robust security measures in online platforms.

Jun 26, 2026

Chinese APT CL-STA-1062 Expands Attacks on Southeast Asian Critical Infrastructure With Custom Malware

Security Affairs

Researchers from Palo Alto Networks Unit 42 have reported that a Chinese-speaking advanced persistent threat group, tracked as CL-STA-1062, has been targeting government and energy networks in Southeast Asia. This group has been active since at least March 2022 and has recently intensified its operations in the region, employing custom malware known as TinyRCT to exploit vulnerabilities in critical infrastructure. The focus on Southeast Asia raises concerns about the security of essential services and the potential for significant disruptions. As these attacks target vital sectors, governments and organizations in the region need to bolster their cybersecurity defenses to mitigate risks posed by such sophisticated threats.

Jun 26, 2026

Meta Is Testing Facial Recognition for Police and Military

Schneier on Security

Meta is currently testing a facial recognition technology that could be integrated into eyeglasses for real-time identification. This development is particularly notable because it is being prototyped in collaboration with a supplier for the Pentagon, raising concerns about privacy and surveillance. The technology seems to be aimed at law enforcement agencies, including ICE, which has expressed interest in deploying similar devices. This initiative could have significant implications for civil liberties, as it may facilitate increased monitoring of individuals in public spaces. The potential for misuse or overreach by authorities also adds to the urgency of the conversation around ethical implications and regulations surrounding facial recognition technology.

Jun 26, 2026

Think tank warns US markets face hidden infrastructure risks

SCM feed for Latest

A new report from the Institute for Critical Infrastructure Technology (ICIT) warns that the U.S. financial markets are at risk due to hidden vulnerabilities in infrastructure concentration. The report indicates that many critical systems are overly reliant on a small number of providers, which could lead to significant disruptions if those providers experience failures or attacks. This concentration poses a challenge to market resilience, as the interconnected nature of these systems means that a single point of failure could have widespread repercussions. The findings urge policymakers and businesses to address these vulnerabilities to ensure the stability and security of the market. Addressing these issues is crucial for maintaining public trust and the overall health of the economy.

Jun 26, 2026

NIST seeks public feedback on updated IoT security guidelines

SCM feed for Latest

The National Institute of Standards and Technology (NIST) has released a draft of updated guidelines aimed at improving the cybersecurity of Internet of Things (IoT) products used by the federal government. Titled 'IoT Product Cybersecurity Guidelines for the Federal Government: Establishing IoT Product Cybersecurity Requirements,' this draft is open for public comment until August 24. The guidelines are intended to set specific cybersecurity standards for IoT devices, which have become increasingly prevalent in both government and private sectors. By seeking feedback, NIST hopes to address potential security gaps and ensure that IoT devices meet certain safety benchmarks. This initiative is crucial as vulnerabilities in IoT products can lead to significant risks, including unauthorized access and data breaches.

Jun 26, 2026

FCC approves new cybersecurity rules for emergency alerts and undersea cables

SCM feed for Latest

The Federal Communications Commission (FCC) has approved new cybersecurity regulations aimed at enhancing the security of the Emergency Alert System (EAS) and Wireless Emergency Alerts (WEA). These systems, which are critical for disseminating emergency information to the public, are vulnerable to hijacking attacks. The new rules are designed to prevent unauthorized access and ensure that alerts sent during emergencies are authentic and reliable. This move comes as a response to increasing concerns about the potential misuse of these systems, which could lead to widespread panic and misinformation. By strengthening these regulations, the FCC hopes to protect public safety and maintain trust in emergency communication channels.

Jun 26, 2026