Cyber Shenanigans: Chinese Hackers Exploit Trimble Cityworks for Cobalt Strike Chaos!
Chinese-speaking threat actor UAT-6382 exploited a vulnerability in Trimble Cityworks to wreak tech havoc. After gaining access, they deployed malware like Cobalt Strike and VShell, turning systems into their personal playground. Caught red-handed, they’re now the cyber equivalent of a kid with their hand in the cookie jar.
Hot Take:
Looks like the hackers have a new favorite plaything! Trimble Cityworks just got a full-on makeover, thanks to a gang of cyber mischief-makers from the East. Who knew asset management software could be so exciting? It’s like “Extreme Makeover: Cyber Edition,” where the prize is access to your utilities! And remember folks, every party has a crasher, even the virtual ones.
Key Points:
- Chinese-speaking threat actor UAT-6382 exploited a vulnerability in Trimble Cityworks.
- The vulnerability, CVE-2025-0944, allows remote code execution and has a CVSS score of 8.6.
- Attacks targeted US local government enterprises starting January 2025.
- Exploitation involved delivering Cobalt Strike and a Go-based remote access tool called VShell.
- Malware TetraLoader was used, built on a framework written in Simplified Chinese.
Already a member? Log in here