Cyber: China-linked APT Exploited Sitecore Zero-day In Critical...

A threat actor likely aligned with China has been observed targeting critical infrastructure sectors in North America since at least last year.

Cisco Talos, which is tracking the activity under the name UAT-8837, assessed it to be a China-nexus advanced persistent threat (APT) actor with medium confidence based on tactical overlaps with other campaigns mounted by threat actors from the region.

The cybersecurity company noted that the threat actor is "primarily tasked with obtaining initial access to high-value organizations," based on the tactics, techniques, and procedures (TTPs) and post-compromise activity observed.

"After obtaining initial access — either by successful exploitation of vulnerable servers or by using compromised credentials — UAT-8837 predominantly deploys open-source tools to harvest sensitive information such as credentials, security configurations, and domain and Active Directory (AD) information to create multiple channels of access to their victims," it added.

UAT-8837 is said to have most recently exploited a critical zero-day vulnerability in Sitecore (CVE-2025-53690, CVSS score: 9.0) to obtain initial access, with the intrusion sharing TTP, tooling, and infrastructure similarities with a campaign detailed by Google-owned Mandiant in September 2025. SiteCore released fixes for the flaw early that month.

While it's not clear if these two clusters are the work of the same actor, it suggests that UAT-8837 may have access to zero-day exploits to conduct cyber attacks.

Once the adversary obtains a foothold in target networks, it conducts preliminary reconnaissance, followed by disabling RestrictedAdmin for Remote Desktop Protocol (RDP), a security feature that ensures credentials and other user resources aren't exposed to compromised remote hosts.

UAT-8837 is also said to open "cmd.exe" to conduct hands-on keyboard activity on the infected host and download several artifacts to enable post-exploitation. Some of the notable tools include -

"UAT-8837 may run a series of commands during the intrusion to obtain sensitive information, such as credentials from victim organizations," researchers Asheer Malhotra, Vitor Ventura, and Brandon White said.

"In one victim organization, UAT-8837 exfiltrated DLL-based shared libraries related to the victim's products, raising the possibility that these libraries may be trojanized in the future. This creates opportunities for supply chain compromises and reverse engineering to find vulnerabili

Source: The Hacker News