TinyRCT Backdoor — CL-STA-1062 (UAT-7237)

CL-STA-1062 (overlaps Cisco Talos UAT-7237) is a Chinese-speaking espionage cluster active since at least March 2022. Unit 42 documented a 2025 campaign — surfacing again in the current intel cycle — in which the group compromised at least ten Southeast Asian organizations, including two state-owned energy operators, exfiltrating databases and web-server source code and maintaining long-dwell access.

The signature implant is TinyRCT, a lightweight C#-based backdoor that masquerades as PerfWatson2.exe (a legitimate Visual Studio telemetry binary) and beacons over HTTP with AES-128-CBC encryption using a hard-coded key. Initial access is via exploitation of public-facing applications and ASPX web shells; the loader uses AppDomainManager injection (a trojanized chrome_setup.zip) to run TinyRCT under a legitimate .NET host. The actor layers open-source tooling — fscan, Mimikatz, JuicyPotato, and SoftEther/VNT VPN tunnels — for discovery, credential theft, privilege escalation, and lateral movement.

Highest-value defensive angle: the masquerade and persistence artifacts are narrow and high-fidelity — PerfWatson2.exe running from %LOCALAPPDATA% instead of a Visual Studio path, the GoogleUpdaterTaskSystem140.0.7272.0 scheduled task, and web-server processes (w3wp.exe) spawning command shells. Those three signals catch the chain end-to-end with very low false-positive cost.

Defender priority: Hunt PerfWatson2.exe executing outside a Visual Studio install path and any IIS worker process spawning cmd.exe/powershell.exe first — these are the earliest reliable footholds in the TinyRCT chain and precede credential theft and lateral movement.

Web-hunter note: IOCs are vendor-attributed and corroborated across two Tier-1 reports. Atomic network IOCs (VPS C2 IPs) are perishable — treat as hunt/enrich after ~90 days. Behavioral signatures (masquerade path, task name, injection chain) are durable.

Hunt hypotheses (ordered by fidelity)

1. H1 — Masquerade (high): PerfWatson2.exe executing from a non-Visual-Studio path (e.g. %LOCALAPPDATA%) is TinyRCT, not telemetry. Very low FP.
2. H2 — Web-shell foothold (high): IIS worker w3wp.exe spawning cmd.exe/powershell.exe/recon tooling indicates ASPX web-shell command execution.
3. H3 — Scheduled-task persistence (high): creation of a task named GoogleUpdaterTaskSystem140.0.7272.0 via schtasks.exe with /rl highest /sc onlogon.
4. H4 — AppDomainManager injection (medium): chrome_setup.exe launched from Downloads loading a sideloaded managed DLL.
5. H5 — Offensive tooling (medium): fscan, JuicyPotato, Mimikatz, SoftEther/VNT present by name or hash.
6. H6 — Self-destruct (medium): choice.exe used as a delay primitive in a self-deletion batch routine.
7. H7 — C2 beacon (high, perishable): outbound connections to the four attributed VPS C2/staging IPs.
8. H8 — Masquerading tunnels (medium): SoftEther/VNT renamed to vmtools.exe/VMware executables running from non-VMware paths.

Attack chain

All indicators trace to Unit 42 (2026-06-25) and Hive Pro (2026-06-29). Network IOCs are VPS-hosted and perishable; hashes and behavioral markers are durable.

• Windows Security 4698 — scheduled-task creation; filter for task name containing GoogleUpdaterTaskSystem140.
• Sysmon Event 11 / IIS logs — new .aspx files written under inetpub\wwwroot outside a deployment window; correlate with w3wp child processes.
• Sysmon Event 1 / 4688 — PerfWatson2.exe with a parent that is not devenv.exe or a Visual Studio installer.
• Windows Security 4624/4672 — logon + privilege assignment bursts on IIS hosts consistent with JuicyPotato SeImpersonate abuse.
• Firewall / proxy logs — HTTP GET/POST to the four attributed VPS IPs; look for fixed ~10-second beacon cadence.
• DNS / NetFlow — long-lived outbound sessions to VPS ranges from web-tier or energy-IT subnets.

Promote Q1 and Q3 to Custom IOAs first — both are high-confidence, low-FP, and cover the earliest reliable stages. Keep Q4/Q5/Q6/Q8 as Investigate-only hunts pending environment baselining.

1 · Remove SeImpersonate from an IIS app-pool identity (PowerShell + secedit)

# Audit which accounts currently hold SeImpersonatePrivilege
secedit /export /areas USER_RIGHTS /cfg C:\temp\rights.inf
Select-String -Path C:\temp\rights.inf -Pattern "SeImpersonatePrivilege"
# Then remove the app-pool virtual account from that line via GPO:
#   Computer Config > Windows Settings > Security Settings > Local Policies >
#   User Rights Assignment > "Impersonate a client after authentication"
# Keep only: Administrators, SERVICE, LOCAL SERVICE, NETWORK SERVICE (as required)

2 · Hunt + remove the persistence task (PowerShell)

Get-ScheduledTask | Where-Object { $_.TaskName -like "GoogleUpdaterTaskSystem140*" } |
  ForEach-Object {
    Write-Host "SUSPECT TASK:" $_.TaskName $_.TaskPath
    # Unregister-ScheduledTask -TaskName $_.TaskName -Confirm:$false   # after triage
  }

3 · Confirm every PerfWatson2.exe is legitimate (PowerShell)

Get-CimInstance Win32_Process -Filter "Name='PerfWatson2.exe'" |
  Select-Object ProcessId, ExecutablePath, CommandLine |
  Where-Object { $_.ExecutablePath -notmatch 'Microsoft Visual Studio' }

4 · Block C2 egress (Windows Firewall example)

$ips = "45.32.113.172","139.180.134.221","202.182.102.5","45.76.210.43"
New-NetFirewallRule -DisplayName "Block CL-STA-1062 C2" -Direction Outbound `
  -RemoteAddress $ips -Action Block -Profile Any
# Prefer enforcing at the perimeter / cloud NSG as the primary control.

Known gaps: environment/sandbox checks (T1497) and RAR-staged chunked exfiltration (T1560.001/T1041) are not directly covered by process telemetry — lean on native audit-log hunts and egress-volume anomaly detection. Validate Q4/Q5 field behavior and app-pool baselines in your tenant before promoting to blocking IOAs.