Ghosted by a cybercriminal
Summary: Cisco Talos research describes threat actors increasingly splitting the attack chain among specialized groups, each handling one slice and passing the breach along like a relay baton. The newsletter notes this compartmentalized model is efficient but brittle, since a flaky affiliate, a broker who sells the same credentials twice, or an actor who never shows up can unravel the whole operation, and it cites Conti's collapse, LAPSUS$ infighting, and a REvil affiliate's forum rant as examples.
What's compelling: The same newsletter reports that UAT-6382, Chinese-speaking threat actors, exploited a remote code execution vulnerability (CVE-2025-0994) in Cityworks, deploying web shells, Rust-based malware loaders, and Cobalt Strike for long-term persistence, and warns exploitation may be continuing in the wild even though the intrusions described were contained.
Read the original at Cisco Talos ↗
- Topics
- Threat Actors & Nation-State
- Mentions
- CVE-2025-0994
- Related
- CVE-2025-0994: Trimble Cityworks Deserialization Vulnerability Known Exploited Vulnerabilities · Feb 07, 2025University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026