The bad actors have exploited the vulnerability since January, delivering malware to local governments and utilities groups.

Trimble Cityworks, software used by cities to manage assets on infrastructure projects, contained a flaw that allowed elevated user permissions.