Exploits Cityworks zero-day vulnerability to deliver malware
Essential information
- Published
- 22/05/2025 14:44
- Modified
- 22/05/2025 15:07
- Tags
- 2025-05-22 CVE-2025-0994 antsword china chopper chinese threat actors cityworks cobalt strike exploitation tetraloader vshell web shells
- Related entities
- 1 vulnerabilities (cve), 18 observables, 1 intrusion sets (apt), 19 techniques (mitre), 5 malware, 2 others
Description
Chinese-speaking threat actors, dubbed UAT-6382, have been exploiting a remote-code-execution vulnerability (CVE-2025-0994) in Cityworks, a popular asset management system. The attacks, which began in January 2025, target local governing bodies in the United States, focusing on utilities management systems. The threat actors deploy various web shells, including AntSword and Chopper, and use custom Rust-based loaders called TetraLoader to deliver Cobalt Strike beacons and VSHell malware. The attackers conduct reconnaissance, enumerate directories, and stage files for exfiltration. Their tooling and tactics indicate a high level of proficiency in the Chinese language, suggesting a Chinese origin for the threat group.