Chinese Hackers Exploit Trimble Cityworks Vulnerability to Gain Access to U.S. Government Networks
May 22, 2025
In a concerning cybersecurity development, a group of Chinese-speaking hackers identified as UAT-6382 has been implicated in exploiting a recently patched vulnerability in Trimble Cityworks. This flaw enabled the group to execute remote code and deploy sophisticated malware, including Cobalt Strike and VShell, into U.S. government networks.
According to a recent analysis from Cisco Talos researchers Asheer Malhotra and Brandon White, UAT-6382 successfully leveraged CVE-2025-0944, a vulnerability rated 8.6 on the CVSS scale, which pertains to the deserialization of untrusted data within the GIS-focused asset management platform. Following their intrusion, the group engaged in extensive reconnaissance activities and established persistent access through a variety of web shells and custom malware, demonstrating a systematic approach to maintaining control over compromised systems.
The attacks, which have primarily targeted enterprise networks belonging to local government entities across the United States, began to surface in January 2025. The interest of UAT-6382 appears to focus on systems involved in utility management, raising alarms about the potential risks to critical infrastructure.
CVE-2025-0944 has been patched, but the exploit underscores the ongoing vulnerabilities faced by software used by government entities. The ability to execute remote code from what should be secure applications reveals a significant gap in cybersecurity resilience, warranting urgent attention from IT departments and cybersecurity professionals alike.
Engaging with the tactics employed by UAT-6382, one can refer to the MITRE ATT&CK framework, which suggests that the primary means of initial access for the attackers likely involved exploiting the aforementioned vulnerability. The use of reconnaissance techniques followed by establishing persistence demonstrates a calculated strategy to maintain access over time.
Privilege escalation techniques could also be inferred, given the group’s intent on pivoting to sensitive systems critical for utility management. Such maneuvers are typical within advanced persistent threat (APT) operations, where cyber actors seek to leverage one compromised node to infiltrate deeper layers of an organization’s network structure.
As the cybersecurity landscape continues to evolve, incidents like these serve as a reminder of the persistent threats targeting governmental and critical infrastructure systems. Business owners are encouraged to remain vigilant, ensuring that all software dependencies are regularly updated and that their cybersecurity frameworks are robust enough to withstand attempted breaches of this nature.
