UAT-6382 exploits Cityworks zero-day vulnerability to deliver malware

Cisco Talos documents active exploitation of CVE-2025-0994 against Cityworks servers by a Chinese-speaking actor (UAT-6382), detailing initial reconnaissance, rapid deployment of AntSword/Chopper web shells, Rust-based TetraLoader loaders (built with MaLoader) used to inject Cobalt Strike beacons and VShell implants, and providing extensive IOCs (file hashes, domains, IPs) and detection/mitigation guidance for affected U.S. local government networks.