Chinese APT CL-STA-1062 targets Southeast Asia with new TinyRCT backdoor

SCM feed for Latest

June 26, 2026 at 10:14 PM

Actively Exploited

Overview

A Chinese cyber espionage group known as CL-STA-1062 is targeting organizations in Southeast Asia using a new backdoor called TinyRCT. This group employs a mix of open-source tools, including SoftEther VPN and Mimikatz, alongside their custom malware. The use of such a hybrid toolkit suggests a sophisticated approach to infiltrating networks and exfiltrating sensitive information. Organizations in Southeast Asia should be especially vigilant, as this attack could compromise critical data and disrupt operations. The ongoing activity of this threat actor raises concerns about the security posture of companies in the region.

Key Takeaways

Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
Affected Systems: SoftEther VPN, Mimikatz, VNT, TinyRCT backdoor
Action Required: Organizations should enhance their network security measures, monitor for unusual activity, and ensure that all software is updated to the latest versions.
Timeline: Newly disclosed

Original Article Summary

CL-STA-1062 employs a hybrid toolkit, combining open-source tools like SoftEther VPN, Mimikatz, and VNT with a newly discovered custom backdoor named TinyRCT.

Impact

SoftEther VPN, Mimikatz, VNT, TinyRCT backdoor

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Newly disclosed

Remediation

Organizations should enhance their network security measures, monitor for unusual activity, and ensure that all software is updated to the latest versions. Implementing strong access controls and user training on phishing awareness may also help mitigate risks.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to APT, Malware, Critical.

Read Original Article

Related Coverage

Chinese Framework Powers 200,000 Scam Sites

SecurityWeek

A recent report reveals that over 200,000 scam websites are using templates generated by a legitimate Chinese framework called DCloud Uni-App. Attackers are exploiting this toolkit to create investment scam sites that trick users into giving away money. This issue is significant because it highlights how easily legitimate software can be misused for fraudulent purposes, putting countless individuals at risk. As these scams proliferate, it becomes crucial for internet users to be vigilant and recognize potential red flags in online investment opportunities. Companies and regulators need to consider stronger measures to combat such deceptive practices.

Jun 27, 2026

Third-Party Breaches Teach Education Sector a Costly Lesson in Vendor Risk

darkreading

Recent breaches involving third-party vendors have put educational institutions on high alert regarding the security of student data. As ransomware attacks become more common, schools and universities are increasingly recognizing the risks associated with relying on external vendors for services. These incidents have revealed vulnerabilities that can expose sensitive information, prompting institutions to strengthen their cybersecurity measures. The need for schools to assess and manage vendor risk is more crucial than ever, as attackers often target less secure third-party systems to gain access to larger networks. This situation not only threatens the privacy of students but also can lead to significant financial and reputational damage for educational organizations.

Jun 27, 2026

2 Linux kernel flaw PoCs published, enabling local privilege escalation

SCM feed for Latest

Recently, two proof-of-concept (PoC) exploits for vulnerabilities in the Linux kernel have been published, enabling local privilege escalation. One of these flaws is known as DirtyClone, which is related to the DirtyFrag vulnerability class. These vulnerabilities could allow attackers with local access to escalate their privileges, potentially gaining control over sensitive system functions. This is particularly concerning for systems that rely heavily on Linux, as it could lead to unauthorized access to critical data and services. Users and administrators should be aware of these vulnerabilities and take necessary precautions to secure their systems against potential exploitation.

Jun 26, 2026

4 arrested in Poland for SIM-swapping and cryptocurrency theft

SCM feed for Latest

Four individuals were arrested in Poland for their involvement in a SIM-swapping scheme that led to cryptocurrency theft. This operation was a joint effort between Poland's Cybercrime Bureau and various U.S. agencies, including the FBI and Homeland Security Investigations. The suspects are accused of breaching telecommunications companies and hijacking email accounts to gain unauthorized access to victims' cryptocurrency wallets. This incident underscores the ongoing risks associated with SIM-swapping, where attackers manipulate mobile phone accounts to intercept sensitive information. As cryptocurrency continues to grow in popularity, the need for enhanced security measures is becoming increasingly important for users and service providers alike.

Jun 26, 2026

Turla group deploys new STOCKSTAY backdoor against Ukraine and Italy

SCM feed for Latest

The Turla group, a sophisticated cyber-espionage team, has rolled out a new backdoor malware called STOCKSTAY, targeting systems in Ukraine and Italy. This malware is built using .NET and employs the Windows Forms framework, allowing it to communicate securely with its command-and-control server through WebSocket connections. The deployment of STOCKSTAY is particularly concerning given the ongoing geopolitical tensions, as it highlights the persistent threat of cyber attacks aimed at destabilizing nations. Organizations in the affected regions need to bolster their cybersecurity measures to protect against such advanced threats. The emergence of this backdoor underscores the continuous evolution of tactics used by cyber adversaries.

Jun 26, 2026

NAIC confirms cyberattack after ShinyHunters claims 3.1TB data theft

SCM feed for Latest

The National Association of Insurance Commissioners (NAIC) has confirmed that it was the target of a cyberattack claiming a massive data theft of 3.1TB. The breach was linked to a zero-day vulnerability in Oracle PeopleSoft, a widely used enterprise resource planning software. The hacking group ShinyHunters has taken responsibility for the incident, raising concerns about the security of sensitive data within the insurance sector. As a result, companies using Oracle PeopleSoft should assess their systems and consider implementing necessary security measures to protect against such vulnerabilities. This incident highlights the ongoing risks associated with software vulnerabilities and the importance of timely patches and updates.

Jun 26, 2026