Chinese threat actors exploited Trimble Cityworks Flaw to breach U.S. local government networks
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-0944 | A vulnerability was found in itsourcecode Tailoring Management System 1.0 | 5.3 | 1% | PoC | |
| CVE-2025-0994 | Authenticated Deserialization RCE in Trimble Cityworks | 8.6 | 31% | KEV | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | cdn.lgaircon.xyz | alt Strike beacons used by UAT-6382 connect to domains like cdn[.]lgaircon[.]xyz and www[.]roomako[.]com via HTTPS, using stealthy confi |
| domain | www.roomako.com | y UAT-6382 connect to domains like cdn[.]lgaircon[.]xyz and www[.]roomako[.]com via HTTPS, using stealthy configs with injected shellco |
From the original article
2 min read at securityaffairs.com
A Chinese threat actor, tracked as UAT-6382, exploited a patched Trimble Cityworks flaw to deploy Cobalt Strike and VShell. Cisco Talos researchers attribute the exploitation of the CVE-2025-0994 in Trimble Cityworks to Chinese-speaking threat actor UAT-6382, based on tools and TTPs used in the intrusions. The vulnerability CVE-2025-0994 (CVSS v4 score of 8.
By @securityaffairs · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.