A China-linked cyber threat group, identified as CL-STA-1062, has shifted its focus from attacking web-hosting infrastructure in Taiwan to compromising critical infrastructure in Southeast Asia, including electricity, water, and government organizations. Researchers from Palo Alto Networks report that the group has deployed a new backdoor tool called TinyRCT, which is small, stealthy, and designed to evade detection.
The group's activities highlight a significant escalation in cyberattacks from China, aimed at establishing long-term compromises within critical systems in the region. While they have been successful in some attacks, indications suggest that their frequency may be declining as they may have refined their concealment methods. The full extent of the group's capabilities and intentions remains under investigation.