Chinese APT CL-STA-1062 Expands Attacks on Southeast Asian Critical Infrastructure With Custom Malware

Multiple security incidents and research reports were published: Palo Alto Unit 42 tracked Chinese-speaking APT CL-STA-1062 conducting long-running operations against Southeast Asian government and energy networks using open-source tools and a new TinyRCT backdoor. SentinelLabs disclosed macOS.Gaslight, a DPRK-linked Rust macOS implant with a prompt-injection payload intended to deceive analysts. CISA added high-risk flaws (including CVE-2026-12569) in Cisco and PTC Windchill/FlexPLM to its Known Exploited Vulnerabilities catalog, and Google/Mandiant reported active exploitation of Cisco SD-WA