UAT-638 Hackers Exploit Cityworks Zero-Day to Attack IIS Servers With VSHell Malware

A sophisticated cyber threat group designated as UAT-6382 has been actively exploiting a critical zero-day vulnerability in Cityworks, a popular asset management system used by local governments across the United States. The vulnerability, tracked as CVE-2025-0994, allows remote code execution and has been under active exploitation since January 2025. The attackers have demonstrated a particular […] The post UAT-638 Hackers Exploit Cityworks Zero-Day to Attack IIS Servers With VSHell Malware appeared first on Cyber Security News.

May 22, 2025 - 20:30

UAT-638 Hackers Exploit Cityworks Zero-Day to Attack IIS Servers With VSHell Malware

A sophisticated cyber threat group designated as UAT-6382 has been actively exploiting a critical zero-day vulnerability in Cityworks, a popular asset management system used by local governments across the United States.

The vulnerability, tracked as CVE-2025-0994, allows remote code execution and has been under active exploitation since January 2025.

The attackers have demonstrated a particular interest in systems related to utilities management, raising concerns about potential disruption to critical infrastructure.

The exploit targets the Cityworks application running on Microsoft Internet Information Services (IIS) servers, giving attackers an initial foothold into government networks.

Once inside, the threat actors rapidly deploy a variety of web shells and custom malware to maintain persistent access.

The intrusions have primarily affected local governing bodies in the United States, with attackers quickly pivoting to systems containing sensitive infrastructure data.

Cisco Talos researchers identified this campaign and have attributed it with high confidence to Chinese-speaking threat actors based on the tools, tactics, and procedures observed.

The researchers noted that many of the deployed web shells contained messages written in Chinese, and the custom malware utilized a builder framework called “MaLoader,” which features a user interface written entirely in Simplified Chinese.

The attack chain begins with exploitation of the Cityworks vulnerability, followed by basic reconnaissance commands to identify server characteristics.

Within minutes, attackers deploy web shells including variants of AntSword and Chopper, allowing them to maintain backdoor access and stage files for exfiltration.

TetraLoader: The Rust-Based Delivery Mechanism

The most distinctive aspect of this campaign is the deployment of a Rust-based loader dubbed “TetraLoader.” This loader serves as the delivery mechanism for more sophisticated payloads including Cobalt Strike beacons and VSHell malware.

TetraLoader is built using a relatively new malware builder framework called “MaLoader” that first appeared on GitHub in December 2024.

MaLoader’s builder interface (Source – Cisco Talos)

TetraLoader functions by decoding an embedded payload and injecting it into legitimate processes like notepad.exe.

The following code snippet illustrates how the VSHell stager processes incoming commands:-

loc_7FF6072D6411:
xor r8d, r8d
test eax, eax
jz short loc_7FF6072D6428
loc_7FF6072D6418:
lea ecx, [r8+rsi]
add r8d, r14d
xor byte ptr [rcx+rdi], 99h
cmp r8d, eax
jb short loc_7FF6072D6418

The VSHell malware itself is written in GoLang and provides comprehensive remote access capabilities including file management, command execution, screenshot capture, and network proxying functionality.

Its command and control interface, while offering limited English language support, predominantly uses Chinese, further supporting attribution to Chinese-speaking operators.

Equip your SOC team with deep threat analysis for faster response -> Get Extra

Read More

Tags:

Previous Article

Cisco Webex Meetings Vulnerability Let Attackers Manipulate HTTP Responses

Next Article

INE Security Partners with Abadnet Institute for Cybersecurity Training Programs...

Related Posts

Windows Defender Application Control Bypassed Using Ope...

May 16, 2025 0

Cobalt Strike 4.11.1 Released With Fix For ‘Enable SSL’...

May 13, 2025 0

Multiple GitLab Vulnerabilities Let Attackers Trigger D...

May 22, 2025 0

Name

Email

Comment