Chinese Hackers Exploit Cityworks Flaw, Unleash Novel Malware Attack

Chinese Hackers Exploit Cityworks Flaw, Unleash Novel Malware Attack

Summary

• Attacks on Infrastructure: China-linked hackers exploited a flaw in Trimble Cityworks, asset management software used by many U.S. local governments, to plant malware.
• Government Concerns: The campaign hit local government networks that manage utilities and public works.
• Advanced Tactics: The attackers used custom loaders and well-known remote access tools to stay hidden.
• Call for Action: Cityworks users are urged to patch and check their servers for signs of compromise.

What Happened

Cisco Talos reported in May 2025 that a Chinese-speaking hacking group it tracks as UAT-6382 had exploited a vulnerability in Cityworks, asset management software from Trimble that many U.S. cities and counties use to run water, roads and other public works. The flaw, CVE-2025-0994, lets an authenticated attacker run code on the server.

Cityworks is common in municipal IT. That made it a useful entry point. Once inside, the attackers dropped web shells and malware onto Microsoft IIS servers running the software.

The Flaw Behind It

Trimble released patches for CVE-2025-0994 in late January 2025, and CISA added it to its Known Exploited Vulnerabilities catalog in February. Talos said the attackers had been exploiting it since at least January, so some victims were hit before or soon after the fix came out.

The intrusions used a Rust-based loader Talos calls TetraLoader, built with a Chinese-language malware builder, to deliver Cobalt Strike and the VShell remote access tool. Both give attackers lasting control of a compromised machine.

Impact and Response

The potential impact is serious. Local governments use Cityworks to manage work orders and assets for water systems, streets and public safety. A compromised server can expose that data and give attackers a foothold in city networks.

Federal agencies and Trimble have urged customers to apply the patches. Talos published indicators of compromise so local IT teams can check their systems.

What Cityworks Users Should Do

Patch Cityworks to a fixed version immediately. Then look for web shells and unexpected files on IIS servers and review logs for unusual activity going back to January 2025.

Patching alone is not enough if attackers are already inside. Teams that find signs of compromise should treat it as an active incident and rebuild affected servers.

The Wider Lesson

Local governments run critical services on small IT budgets, and attackers know it. Fast patching of internet-facing software helps. So do monitoring and incident plans that are written down and rehearsed.

The Cityworks attacks are a reminder that software most people have never heard of can be a direct path into the systems that keep water flowing and streets maintained. Securing it is a basic public safety task.

Expect more of this.

Dan Evert, CCNP

Dan Evert is a self proclaimed Router Jockey. Dan got heavily involved in networking right out of high school and has never looked back! Dan is giving back by working with high school students to get them involved and interested in Networking and Security.