Trimble Cityworks is a GIS-centric asset lifecycle management system used by local authorities, utilities, airports, and public enterprises to manage and maintain infrastructure.
The UAT-6382 hacker group used Rust-based loaders to deploy Cobalt Strike and VSHell malware on vulnerable hosts to maintain long-term persistent access. The malware subsequently deployed web shells to establish backdoor entries into the compromised networks.
Attacks on Trimble Cityworks began in January 2025; at that time, Cisco Talos detected suspicious activity on networks of the affected organizations.
Talos has found intrusions in enterprise networks of local governing bodies in the United States (U.S.), beginning January 2025 when initial exploitation first took place. UAT-6382 successfully exploited CVE-2025-0944, conducted reconnaissance and rapidly deployed a variety of web shells and custom-made malware to maintain long-term access. Upon gaining access, UAT-6382 expressed a clear interest in pivoting to systems related to utilities management. The web shells, including AntSword, chinatso/Chopper and generic file uploaders, contained messaging written in the Chinese language. Furthermore, the custom tooling, TetraLoader, was built using a malware-builder called “MaLoader” that is also written in Simplified Chinese,” – Cisco Talos.
The attacks exploited a vulnerability identified as CVE-2025-0994 and enabling authenticated attackers to remotely execute code on Microsoft Internet Information Services (IIS) servers.
In early February 2025, Trimble released patches fixing this issue. The developers reported that they were aware of attacks exploiting CVE-2025-0994 to compromise Cityworks deployments.
On February 7, the Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2025-0994 to its Known Exploited Vulnerabilities Catalog and requested US federal agencies to remediate the identified vulnerabilities within three weeks.