Chinese-speaking hackers targeting US municipalities with Cityworks bug

Cisco Talos observed Chinese-speaking threat actors actively exploiting CVE-2025-0994 in Trimble Cityworks since January, using web shells and MaLoader-based custom malware to conduct reconnaissance, maintain persistent access, and attempt pivots to utilities management; Trimble and CISA issued advisories and customers were instructed to patch by February 28.