• CVE-2025-0944
• Uat-6382
• Critical Infrastructures
• Tetraloader
• Cve-2025-0944
• Trimble
• Government
• North America
• Business Services
• United States

Chinese Threat Actor UAT-6382 Exploits Vulnerability in Trimble Cityworks

A Chinese-speaking threat actor known as UAT-6382 has been linked to the exploitation of a recently patched remote-code-execution vulnerability (CVE-2025-0944) in Trimble Cityworks. This group successfully targeted enterprise networks of local governing bodies in the United States, deploying various web shells and custom malware, including Cobalt Strike and a Rust-based loader called Tetraloader, to maintain long-term access to compromised systems. The attacks began in January 2025, and the vulnerability was added to the U.S. Cybersecurity and Infrastructure Security Agency's known exploited vulnerabilities catalog in February 2025.