Forensia CTI Core

Summary

Ingested excerpt (first ~500 chars of normalized text).

CL-STA-1062 Targets Southeast Asian Governments and Critical Infrastructure Government entities and critical infrastructure were targeted for espionage in SE Asia by attackers using a hybrid toolkit, including custom TinyRCT backdoor. The post CL-STA-1062 Targets Southeast Asian Governments and Critical Infrastructure appeared first on Unit 42 . CL-STA-1062 Targets Southeast Asian Governments and Critical Infrastructure Menu Tools ATOMs Security Consulting About Us Under At…

https://unit42.paloaltonetworks.com/cl-sta-1062-tinyrct-backdoor

sha256:55516d10728714a87ec3c4f89f051cee4e2c42b8ea9afae29312ec913d213eb5

What we pulled out

Deterministic extractor (IOC + allowlisted tokens + ATT&CK IDs present in DB).

cve0
md50
url0
ipv44
ipv60
sha10
domain9
sha2566
malware_token0
attack_pattern0
threat_actor_token0

Indicators

Linked with report → mentions → indicator. Values open the indicator workspace.

Type	Value	Link
domain	cmd.exe	Open →
domain	vmtools.exe	Open →
domain	exe.config	Open →
sha256	f34bd1d485de437fe18360d1e850c3fd64415e49d691e610711d8d232071a0b1	Open →
sha256	00e09754526d0fe836ba27e3144ae161b0ecd3774abec5560504a16a67f0087c	Open →
sha256	4e1f8888d020decd09799ec946f1bf677cac6612b24582ddbf4d8ede425d8384	Open →

Malware families

Allowlist token matches only.

None extracted.

Threat actors mentioned

Allowlist mentions — not a formal attribution verdict.

None extracted.

ATT&CK techniques

MITRE IDs referenced in text and present in local technique table.

None linked (import ATT&CK or adjust text).

CONTINUE INVESTIGATION

High-signal pivots without leaving the thread you started in search.

All reports
Browse the report corpus.
Intel graph (first IOC)
Neighborhood from the first linked indicator.

← Back to reports