Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit NetSec

Reddit Cybersecurity

ThreatFox MISP Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

Bleeping Computer

GCVE Database

CIRCL OSINT Feed

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Chinese-speaking threat actors, dubbed UAT-6382, have been exploiting a remote-code-execution vulnerability (CVE-2025-0994) in Cityworks, a popular asset management system. The attacks, which began in January 2025, target local governing bodies in the United States, focusing on utilities management systems. The threat actors deploy various web shells, including AntSword and Chopper, and use custom Rust-based loaders called TetraLoader to deliver Cobalt Strike beacons and VSHell malware. The attackers conduct reconnaissance, enumerate directories, and stage files for exfiltration. Their tooling and tactics indicate a high level of proficiency in the Chinese language, suggesting a Chinese origin for the threat group.

The threat involves a remote code execution (RCE) zero-day vulnerability identified as CVE-2025-0994 in Cityworks, a widely used asset management system primarily deployed by local government entities for utilities and infrastructure management. Since January 2025, a Chinese-speaking threat actor group known as UAT-6382 has been actively exploiting this vulnerability. The exploitation chain begins with the attackers leveraging the RCE flaw to gain unauthorized access to Cityworks servers. Once inside, they deploy multiple web shells, including AntSword and China Chopper variants, to maintain persistent access and facilitate further operations. The attackers utilize a custom Rust-based loader named TetraLoader to deliver advanced payloads such as Cobalt Strike beacons and VSHell malware, which are commonly used for command and control, lateral movement, and data exfiltration. Their activities include reconnaissance of the compromised environment, directory enumeration, and staging of files for exfiltration, indicating a focus on intelligence gathering and potential disruption or espionage. The tooling and operational tactics demonstrate a high level of sophistication and fluency in Chinese, strongly suggesting the threat actor’s origin. Despite the absence of publicly available patches or CVSS scoring, the exploitation of a zero-day in critical infrastructure management software combined with advanced malware deployment underscores a significant threat to targeted organizations.

Detailed information about Exploits Cityworks zero-day vulnerability to deliver malware. Get real-time updates, technical details, and mitigation strategies.

Exploits Cityworks zero-day vulnerability to deliver malware - Live Threat Intelligence - Threat Radar | OffSeq.com

Exploits Cityworks zero-day vulnerability to deliver malware

Threats Tagged 'chinese threat actors'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'chinese threat actors'

Lead Pen Test Professional