Ghosted by a cybercriminal

Talos' weekly Threat Source newsletter discusses compartmentalized threat actor ecosystems and reports that UAT-6382 (Chinese-speaking actors) exploited Cityworks via CVE-2025-0994, deploying web shells, Rust-based malware loaders and Cobalt Strike for persistent access; it provides IOCs and malware hashes, and highlights related security headlines including VMware patches and a ransomware outage at Kettering Health.