Chinese-Speaking Hackers Deploy TinyRCT Backdoor Against Critical Energy Infrastructure

A Chinese-speaking threat cluster tracked as CL-STA-1062 has deployed a newly discovered .NET backdoor, TinyRCT, in targeted campaigns against government and critical energy infrastructure across Southeast Asia during 2025.

The recent campaign combines common open-source tooling with bespoke malware. Operators consistently leverage publicly available utilities SoftEther VPN for tunneling, VNT and yuze for covert command-and-control, and credential harvesters such as Mimikatz often disguising binaries as legitimate system files.

These familiar tools are paired with ASPX web shells used to gain initial footholds via vulnerable web applications. From web-shell access the group stages reconnaissance, executes lateral-movement attempts, and stages data for exfiltration, commonly compressing findings into password protected RAR archives before transfer.

TinyRCT represents a material escalation in tradecraft. Discovered on attacker infrastructure as PerfWatson2.exe, the backdoor is a lightweight C# RAT that enforces strict execution checks: it aborts unless run from %LOCALAPPDATA%, and the associated loader likewise validates execution from the user’s Downloads folder, a tactic designed to frustrate sandbox and analyst analysis.

TinyRCT fingerprints hosts upon launch collecting username, machine name, OS version, local IP addresses, execution path, PID and a GUID encrypts the profile, and registers with a C2 server, establishing a persistent, AES-128-CBC encrypted HTTP channel to 45.32.113[.]172.

Unit 42 said in a report shared with GBhackers, telemetry links this cluster to long-running activity since March 2022 and aligns it with the actor Cisco Talos labeled UAT-7237 for earlier web-hosting attacks in Taiwan, indicating a persistent regional focus and an evolution from opportunistic intrusions.

TinyRCT Backdoor Deployed

The malware uses a short beacon interval by default and supports a compact but effective command set: arbitrary shell execution, directory enumeration, file read/download/exfiltration (in 40 KB AES-encrypted chunks), screen capture, configuration updates.

The infection chain reconstructed by analysts shows a socially plausible dropper: a chrome_setup.zip archive containing a signed chrome_setup.exe, a malicious chrome_setup.exe.config and a MyAppDomainManager.dll loader that abuses .NET AppDomainManager injection to run code within the context of a trusted process.

The loader retrieves PerfWatson2.exe from staging infrastructure (139.180.134[.]221), writes it to %LOCALAPPDATA%, and establishes persistence by creating a high-privilege scheduled task (GoogleUpdaterTaskSystem…).

This combination of trusted-process injection, environmental checks, and masquerading increases stealth and longevity in targeted networks.

Observed intrusions in 2025 included database exfiltration from government entities, harvesting of web-server source code, and prolonged access to at least two state-owned critical energy organizations in the same Southeast Asian country.

Telemetry indicates the actor performed reconnaissance to identify lateral pathways and deployed tunneling tools and payloads that bridged initial web compromise to internal asset access.

Detection and mitigation hinge on layered controls: rigorous web-application defenses to block initial ASPX web-shell deployment, strict application allowlisting and behavioral execution controls to prevent execution from nonstandard locations, monitoring for unusual outbound HTTP patterns.

Customers can prioritize endpoint behavioral monitoring and network telemetry to detect TinyRCT’s registration beacons and its characteristic encrypted POSTs.

Organizations suspecting compromise should engage incident response and map inbound staging servers and scheduled tasks to rapidly disrupt persistence.

For additional technical context and defensive guidance, see Unit 42’s attribution framework on CL-STA-1062 and prior reporting by Cisco Talos on UAT-7237, and consult vendor advisories detailing detection rules for TinyRCT and associated tooling.

Indicators of Compromise

File name	SHA256 hash
chrome_setup.zip	00e09754526d0fe836ba27e3144ae161b0ecd3774abec5560504a16a67f0087c
fscan	f34bd1d485de437fe18360d1e850c3fd64415e49d691e610711d8d232071a0b1
SoftEther VPN	dce5df29bddff5a4ddaea5c4fec14da91f7b69063a6e1c45ed61e5da4fc6c87b
TinyRCT downloader	cbfe8de6ffadbb1d396f61e63eb18e8b11c29527c1528641e3223d4c516cf7c3
TinyRCT	4e1f8888d020decd09799ec946f1bf677cac6612b24582ddbf4d8ede425d8384
VNT	9b481b69cd91b09fa7bae7428f646dd89473a4c03393e43da81fe756cde1c472

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.