Hackers are hijacking government software to access sensitive servers

• Trimble warns Cityworks is being abused in RCE attacks
• The company released a patch to address the issue
• CISA warns users to apply patch as soon as possible

Hackers are hijacking government software to access sensitive servers, experts have warned.

The warning comes from software vendor Trimble, whose product seems to have been used in the attack. In a letter sent to its customers and partners, Trimble said it observed cybercriminals abusing a deserialization vulnerability in its Cityworks product to engage in Remote Code Execution (RCE) and deploy Cobalt Strike beacons on Microsoft Internet Information Services (IIS) servers.

Trimble Cityworks is a Geographic Information System (GIS) asset management and permitting software designed to help local governments and utilities manage infrastructure, maintenance, and operations efficiently. It was found to have been vulnerable to CVE-2025-0994, a high-severity deserialization bug allowing for RCE, given a severity score of 8.6 (high).

Patching the flaw

“Following our investigations of reports of unauthorized attempts to gain access to specific customers’ Cityworks deployments, we have three updates to provide you,” the company said in the letter. To tackle the threat, Trimble updated Cityworks 15.x to version 15.8.9, and 23.x to 23.10. It also warned about discovering some on-prem deployments having overprivileged IIS identity permissions, and added that some deployments haid incorrect attachment directory configurations.

All of these should be addressed at the same time, to mitigate the threat and resume normal operations with Cityworks.

We don’t know how big the attack is, or if any organizations were compromised as a result, but the US Cybersecurity and Infrastructure Security Agency (CISA) has released a coordinated advisory, urging customers to apply the patches as soon as possible, BleepingComputer has found. “CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures,” it was said in the advisory.

“Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.”

Via BleepingComputer

You might also like

• Bad news — many of today's top passwords can be brute force cracked in less than an hour
• We've rounded up the best password managers
• Take a look at our guide to the best authenticator app