CL-STA-1062 Targets Southeast Asian Governments and Critical Infrastructure

Executive Summary

Throughout 2025, we observed a cluster of activity targeting government entities and critical infrastructure in Southeast Asia. Specifically, the activity targeted state-owned enterprises in the energy and government sectors. The Chinese-speaking attackers behind this cluster, which we track as CL-ST

least March 2022. We assess with high confidence that this is the same cluster, known as UA reported for its campaigns against web hosting infrastructure in T

1062 campaigns in earlier operations targeting strategic sectors in East

regional focus.

From a t…