UAT-6382 exploits Cityworks zero-day vulnerability to deliver malware
Summary: Cisco Talos reported intrusions into U.S. local government networks beginning January 2025, where UAT-6382 exploited CVE-2025-0944 in the Cityworks application and deployed web shells including AntSword, chinatso/Chopper and Behinder, plus a custom Rust-based loader called TetraLoader built with the Simplified Chinese MaLoader framework. Talos assesses with high confidence that UAT-6382 is a Chinese-speaking threat actor, citing the Chinese-language tooling, TTPs, hands-on-keyboard activity and victimology, and notes the group showed clear interest in pivoting to systems related to utilities management.
Why it matters: The target set was local governing bodies, and the actor's stated pivot interest was utilities management - so the blast radius of a compromised Cityworks server reaches past the licensing desk toward operational systems.
Read the original at Cisco Talos ↗
- Topics
- Malware
- Mentions
- CVE-2025-0944
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026