UAT-6382
UAT-6382 is a threat activity cluster tracked by Cisco Talos. Talos assesses with high confidence that it is operated by Chinese-speaking threat actors. The cluster is associated with active exploitation of CVE-2025-0994, a remote code execution vulnerability in Trimble Cityworks, with observed intrusions beginning in January 2025 against enterprise networks of local governing bodies in the United States. Talos also observed interest in pivoting toward systems related to utilities management. Post-compromise activity included rapid deployment of IIS web shells and file uploaders, including AntSword, Chopper/chinatso, Behinder, and generic uploaders, with Chinese-language messaging in the tooling. Observed hands-on-keyboard activity included reconnaissance and directory enumeration using commands such as ipconfig, pwd, dir, and tasklist, as well as staging backup archives into web-accessible upload directories for exfiltration. UAT-6382 used a Rust-based loader tracked as TetraLoader, built with the Chinese-language MaLoader framework, to inject payloads into benign processes such as notepad.exe. Talos observed TetraLoader deploying both Cobalt Strike beacons and a VShell stager. The VShell stager, SNOWLIGHT, was used by UAT-6382 to deliver the GoLang-based VShell remote access trojan, which supports file management, arbitrary command execution, screenshots, and NPS-based proxying. Talos noted that SNOWLIGHT has also been used by UNC5174, UNC6586, UAT-8302, and UAT-6382. Talos further observed that SNOWLIGHT used by UAT-8302 shared the same single-byte XOR key and stager behavior seen in UAT-6382 activity. Known alias in the provided content is UAT-6382.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- Government & Administration
- Utilities
Where they target
Geographies tied to known operations.
- 🇺🇸 United States
Tradecraft
12 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
8 malware families attributed to this actor across reporting.
3 additional families tracked in Mallory.
Associated vulnerabilities
2 CVEs this actor has used in observed campaigns. 2 of them exploited in the wild.
Talos has found intrusions in enterprise networks of local governing bodies in the United States (U.S.), beginning January 2025 when initial exploitation first took place. UAT-6382 successfully exploited CVE-2025-0944, conducted reconnaissance and rapidly deployed a variety of web shells and custom-made malware to maintain long-term access.
Cisco Talos has observed exploitation of CVE-2025-0994, a remote-code-execution vulnerability in Cityworks, a popular asset management system. The Cybersecurity and Infrastructure Security Agency (CISA) and Trimble have both released advisories pertaining to this vulnerability...
Observables
19 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Threat cluster associated with use of the SNOWLIGHT VShell stager.
Threat cluster observed exploiting a Cityworks zero-day to deploy VSHELL using the SNOWLIGHT stager.
Chinese-speaking intrusion cluster exploiting Trimble Cityworks CVE-2025-0944 to deploy web shells/custom malware and post-exploitation tooling (Cobalt Strike, VShell) for long-term access.
Exploitation of Cityworks to compromise U.S. local government enterprise networks, followed by rapid web shell deployment, reconnaissance, persistence, and pivoting toward utilities-related systems.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.