Threats tagged 'cityworks'

A remote code execution zero-day vulnerability (CVE-2025-0994) in Cityworks, an asset management system, is actively exploited by a Chinese-speaking threat group called UAT-6382. The attacks, ongoing since January 2025, target local government utilities management systems in the United States. The attackers deploy web shells such as AntSword and Chopper, and use custom Rust-based loaders named TetraLoader to deliver Cobalt Strike beacons and VSHell malware. Their operations include reconnaissance, directory enumeration, and staging files for exfiltration. This activity demonstrates a high level of sophistication and language proficiency consistent with Chinese origin threat actors.