Chinese APT CL-STA-1062 Expands Attacks on Southeast Asian Critical Infrastructure With Custom Malware

Multiple high-impact security developments: Palo Alto Unit 42 links Chinese-speaking APT CL-STA-1062 to persistent operations in East and Southeast Asia using custom tooling and a new TinyRCT backdoor targeting government and energy networks. Google/Mandiant reported active exploitation of Cisco Catalyst SD‑WAN zero-day CVE-2026-20245 months before disclosure, while CISA added Cisco and PTC Windchill/FlexPLM flaws (including CVE-2026-12569) to its Known Exploited Vulnerabilities catalog. Other notable incidents include a Polymarket third‑party supply-chain compromise that enabled ~$2.94M in盗/失