Threats Tagged 'cve-2025-0994'

Chinese-speaking threat actors, dubbed UAT-6382, have been exploiting a remote-code-execution vulnerability (CVE-2025-0994) in Cityworks, a popular asset management system. The attacks, which began in January 2025, target local governing bodies in the United States, focusing on utilities management systems. The threat actors deploy various web shells, including AntSword and Chopper, and use custom Rust-based loaders called TetraLoader to deliver Cobalt Strike beacons and VSHell malware. The attackers conduct reconnaissance, enumerate directories, and stage files for exfiltration. Their tooling and tactics indicate a high level of proficiency in the Chinese language, suggesting a Chinese origin for the threat group.

MediumMalwareUnited KingdomGermanyFrance+7#web shells#chinese threat actors#china chopper

CVE-2025-0994 is a high-severity deserialization vulnerability in Trimble Cityworks versions prior to 15.8.9 and Cityworks with office companion versions prior to 23.10. It allows an authenticated user to execute remote code on the Microsoft IIS web server hosting the application. The vulnerability arises from unsafe deserialization of untrusted data. No known exploits are reported in the wild. Patch status is not confirmed from the provided data.