UAT-8302 and its box full of malware

Technical details

Affected software: Cityworksby Trimble, Cityworks (with office companion)by Trimble

CVE-2025-0994 describes UAT-8302, a China-nexus advanced persistent threat (APT) group that has targeted government entities in South America since at least late 2024 and government agencies in southeastern Europe in 2025. The group deploys multiple custom malware families, including -based backdoor called NetDraft, which is a C variant of the FinalDraft/SquidDoor malware family. This malware is associated with known China-linked APT clusters such as Jewelbug (REF7707, CL-STA-0049, LongNosedGoblin).

Additionally, UAT-8302 employs an updated version of the CloudSorcerer backdoor, previously used against Russian government targets in 2024. The group also leverages VSHELL alongside its SNOWLIGHT stager and introduces a new Rust-based stager called SNOWRUST. Researchers assess with high confidence that UAT-8302 operates as a China-linked APT group focused on maintaining long-term access to government and related entities globally.

Post-compromise activities include information collection, credential extraction, and lateral movement, utilizing open-source tools like Impacket and proxying utilities alongside custom malware. The malware deployed by UAT-8302 links the group to other publicly documented China-linked threat clusters, suggesting operational collaboration.