SecuriTricks - web shells

Exploits Cityworks zero-day vulnerability to deliver malware

Chinese-speaking threat actors, dubbed UAT-6382, have been exploiting a remote-code-execution vulnerability (CVE-2025-0994) in Cityworks, a popular asset management system. The attacks, which began in January 2025, target local governing bodies in the United States, focusing on utilities management…

cobalt strike

exploitation

china chopper

chinese threat actors

Published: May 22, 2025

Linked vulnerabilities : CVE-2025-0944 (CVSS 6.3)

Downloadable IOCs: 18

Investigating Iranian Intrusion into Strategic Middle East Critical Infrastructure

This report details a prolonged Iranian state-sponsored intrusion into critical national infrastructure in the Middle East from May 2023 to February 2025. The threat actors employed various tactics including web shells, custom malware, and legitimate tools to maintain persistent access across multi…

apt

credential harvesting

critical infrastructure

Published: May 6, 2025

Downloadable IOCs: 35

Weaver Ant, the Web Shell Whisperer: Tracking a China-Nexus Cyber Operation

Sygnia uncovered a sophisticated China-nexus threat actor, Weaver Ant, targeting a major Asian telecom company. The group employed web shells and tunneling techniques for persistence and lateral movement, maintaining access for over four years. They utilized encrypted China Chopper and custom 'INMe…

Published: March 25, 2025

Downloadable IOCs: 1

Tag: web shells

Attack reports

Exploits Cityworks zero-day vulnerability to deliver malware

Investigating Iranian Intrusion into Strategic Middle East Critical Infrastructure

Weaver Ant, the Web Shell Whisperer: Tracking a China-Nexus Cyber Operation