China-linked APT UAT-8837 Targets Critical Infrastructure via Sitecore Zero-Day
BLUF
A China-linked Advanced Persistent Threat (APT) actor, tracked as UAT-8837, is actively exploiting a zero-day vulnerability in the Sitecore content management system to gain initial access to North American critical infrastructure entities. The campaign has the potential to lead to further supply chain compromises by trojanizing legitimate product libraries after data exfiltration.
Executive Cost Summary
This cost analysis was developed by the CyberDax team using expert judgment and assisted analytical tools to support clarity and consistency.
For organizations affected by a Sitecore zero-day exploited by a China-linked APT targeting critical infrastructure:
· Low-end total cost: $2.5M – $4.0M
o (limited lateral movement, rapid detection, minimal partner exposure)
· Typical expected range: $6.0M – $12.0M
o (hands-on-keyboard access, credential theft, multi-week remediation)
· Upper-bound realistic scenarios: $15.0M – $25.0M
o (extended dwell time, supply chain impact, regulatory escalation)
Key Cost Drivers
· Duration of attacker dwell time prior to detection
· Scope of identity and credential compromise across environments
· Dependency of revenue operations on Sitecore-backed services
· Regulatory sensitivity of supported critical infrastructure sectors
· Cyber insurance coverage limitations for state-linked activity
Targeted Sectors
Critical Infrastructure (specifically engineering support to major utilities, rail manufacturing, defense-linked robotics, aviation maintenance).
Countries
· Primarily the U.S.
· Canada
· Turkey
· Spain
· China (origin of APT)
Date of First Reported Activity
· At least as early as 2025
Date of Last Reported Activity Update
· January 16, 2026
APT Names
· UAT-8837 possibly associated with a China-nexus group.
Associated Criminal Organization Names
· None reported (state-sponsored activity is likely).
IOCs
Vulnerability & Initial Access
· CVE-2025-53690
o A ViewState Deserialization zero-day in Sitecore products used for initial access.
Exploitation Method
· Leverages exposed or static ASP.NET machine keys (often from old Sitecore documentation) to launch code injection attacks.
Network & Reconnaissance Commands
The actor executes standard Windows commands shortly after compromise to map the environment:
· ping google[.]com (connectivity check)
· tasklist /svc
· netstat -aon -p TCP
· whoami, quser, hostname
· net user
Persistence & Lateral Movement
· RDP Modification
o Disabling "RestrictedAdmin" via the registry to facilitate credential harvesting for remote sessions:
§ REG ADD HKLM\System\CurrentControlSet\Control\Lsa /v DisableRestrictedAdmin /t REG_DWORD /d 00000000 /f
Account Manipulation
· Creating local administrator accounts that mimic service accounts (e.g., ASP.NET service names) to blend in.
· Credential Dumping
o Harvesting password hashes from the SYSTEM and SAM registry hives.
Tools Used in Campaign
· GoTokenTheft
· EarthWorm (SOCKS reverse tunnel)
· DWAgent (persistence/AD recon)
· SharpHound
· Impacket
· GoExec
· Rubeus
· Certipy
Malware Names
GoTokenTheft
EarthWorm
Malware Samples
GoTokenTheft
sha256
43b0ac119ff957bb209d86ec206ea1ec3c51dd87bebf7b4a649c7e6c7f3756e7
Malware Family
· Classified as a Token Stealer or Credential Stealer utility.
o While often categorized under the broad "Infostealer" umbrella, it is specifically a post-exploitation tool rather than a standalone malware family like Redline or Vidar
Verdict
· Malicious
Known Decoding Key
· While specific samples may use varying encryption for exfiltration, recent analysis of similar Golang-based tools indicates the use of XOR-based or AES-GCM encryption for configuration strings. A common 0x40-byte offset is often used in Go-based implants to locate encrypted data blobs.
Primary Objectives
Token Stealing
· Harvesting access tokens from memory to hijack active user sessions.
Privilege Escalation
· Utilizing stolen tokens to run commands with elevated administrative privileges.
Session Persistence
· Enabling the actor to maintain access without needing a valid password.
Threat Actor Context
· Strongly attributed to UAT-8837, a China-nexus threat actor.
Behavior Analysis
Deployment
· Often dropped at C:\Users\<user>\Desktop\go.exe or hidden in temporary directories.
System Modification
· Modifies the Windows Registry (e.g., REG ADD HKLM\System\CurrentControlSet\Control\Lsa /v DisableRestrictedAdmin) to facilitate credential harvesting.
Hands-on-Keyboard
· Frequently used alongside other tools like EarthWorm (for tunneling), SharpHound (for AD reconnaissance), and DWAgent (for remote access).
Evasion
· Attackers often remove temporary accounts and the tool itself once administrator credentials have been successfully exfiltrated.
EarthWorm
sha256
b3f83721f24f7ee5eb19f24747b7668ff96da7dfd9be947e6e24a688ecc0a52b
Malware Name
· Earthworm
Malware Family
· Banking Trojan / Botnet
Known Decoding Key
· Varies by campaign
o Historically uses hardcoded AES keys or specific XOR patterns for its network communications and self-extraction routines.
Verdict
· Malicious
Primary Objectives
· Data Theft Stealing
o User credentials
o Financial information
o Email contact lists.
Secondary Payload Delivery
Acting as a "dropper" or distribution service for other malware such as TrickBot or ransomware (e.g., Conti, Ryuk).
· Threat Actor Context
o Primarily associated with the Mummy Spider threat group.
§ It is known for its high resilience, modular nature, and distribution via massive spam
Behavior Analysis
Execution
Typically initiates via a malicious Microsoft Office macro or a heavily obfuscated PowerShell script.
· Persistence: Achieves persistence by creating scheduled tasks or adding entries to the Windows registry to ensure it runs upon system boot.
· Network Activity: Communicates with Command and Control (C2) servers via HTTP/HTTPS to receive encrypted instructions and exfiltrate harvested data.
· Evasion: Uses polymorphism to change its file signature frequently, making detection via static hashes more difficult.
CVE-2025-20393
CVSS v3.1
· (10.0) 1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Nessus ID
· There is no Tenable plugin ID at this time
Is this on the KEV list?
· Yes
CISA patch by date
· December 24, 2025
URL to patch information
· There is no patch this is the CISCO advisory
hxxps://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-sma-attack-N9bf4
Mitigation
· Organizations should restrict internet exposure of affected appliances
· Block internet access to vulnerable ports
· Restrict access to trusted hosts
Cisco Recommendations
· If an appliance has been identified as having the web management interface or the Spam Quarantine port exposed to and reachable from the internet, Cisco strongly recommends following a multi-step process to restore the appliance to a secure configuration, when possible. For additional information, see Useful Resources at the end of this section.
· If restoring the appliance is not possible, Cisco recommends contacting TAC to check whether the appliance has been compromised. In case of confirmed compromise, rebuilding the appliances is, currently, the only viable option to eradicate the threat actors persistence mechanism from the appliance.
· In addition, Cisco strongly recommends restricting access to the appliance and implementing robust access control mechanisms to ensure that ports are not exposed to unsecured networks.
TTPs
Initial Access
· T1190 – Exploit Public-Facing Application: Exploiting CVE-2025-53690, a ViewState Deserialization zero-day vulnerability in Sitecore products.
· T1078 – Valid Accounts: Using compromised credentials to gain entry or maintain presence.
Execution & Persistence
· T1203 – Exploitation for Client Execution: Specifically leveraging deserialization of untrusted data to execute code.
· T1543.003 – Create or Modify System Process: Windows Service: Installing remote access agents (e.g., DWAgent) as persistent services.
· T1098 – Account Manipulation: Disabling password expiration policies and creating new local administrator accounts to maintain access.
Discovery & Reconnaissance
· T1087.002 – Account Discovery: Domain Account: Using tools like SharpHound and Certipy to map Active Directory and domain information.
· T1018 – Remote System Discovery: Deploying the WEEPSTEEL reconnaissance malware to stealthily map internal environments and extract configuration files.
· T1082 – System Information Discovery: Harvesting security configurations and domain details.
Privilege Escalation & Credential Access
· T1003.002 – OS Credential Dumping: Security Account Manager (SAM): Dumping SAM database files to harvest cached credentials after escalating to local administrator.
· T1528 – Steal Application Access Token: Executing the GoTokenTheft tool to steal access tokens for elevated command execution.
Lateral Movement & Command and Control
· T1572 – Protocol Tunneling: Utilizing the Earthworm tunneling utility to expose internal endpoints to attacker-controlled infrastructure.
· T1021.001 – Remote Services: Remote Desktop Protocol: Disabling RestrictedAdmin for RDP to facilitate easier lateral movement within the network.
· T1105 – Ingress Tool Transfer: Staging various open-source and custom tools (e.g., DWAgent, GoExec) in public directories on compromised servers.
· Defense Evasion
· T1027 – Obfuscated Files or Information: Cycling through different versions of tools (like GoExec) to bypass endpoint security (EDR) detections.
· T1070.001 – Indicator Removal: File Deletion: Removing temporary accounts and cleaning up artifacts once permanent administrative access is established.
Suggested Rules / potential hunts
As a reminder, these are indicator rules. They are likely to be noisy.
For best results consider creating a data model and reviewing the traffic as a report.
Suricata
Monitor for POST requests to /sitecore/blocked.aspx containing high-entropy or unusually large __VIEWSTATE payloads.
Rule Concept - Tool Communication:
Earthworm (SOCKS Tunneling): Alert on non-standard protocol traffic (SOCKS5) over common ports like 80/443 or high ports.
DWAgent: Detect traffic to known DWAgent relay domains or heartbeat patterns associated with the agent.
SentinelOne
Monitor for w3wp.exe (IIS) spawning cmd.exe or powershell.exe, followed by reconnaissance commands: whoami, tasklist /svc, netstat -aon, and quser.
Credential Theft Hunt
Look for reg.exe or powershell.exe modifying the registry to disable RestrictedAdmin for RDP:
REG ADD HKLM\System\CurrentControlSet\Control\Lsa /v DisableRestrictedAdmin /t REG_DWORD /d 0 /f.
Detect attempts to export SYSTEM or SAM hives (e.g., via reg save) to extract local password hashes.
Known Tool Execution
Hunt for file writes or executions of GoTokenTheft, EarthWorm.exe, SharpHound.exe, or Certipy in staging directories like C:\Windows\Temp\ or C:\Users\Public\Music\.
Splunk
Account Manipulation
Monitor Windows Event Log 4720 (Account Created) followed by 4732 (Member added to local Administrators) where the account name mimics service accounts (e.g., ASP.NET_Service).
Search for net user commands used to disable password expiration:
index=windows sourcetype=WinEventLog:Security EventCode=4738 | search "Password Not Required" OR "Password Does Not Expire"
Delivery Method
· Exploitation of a vulnerable public-facing application (Sitecore CMS) and potential spear-phishing campaigns.
Email Samples
No specific email samples have been publicly disclosed in the last 24 hours, but general phishing is a consistent threat.
References
Industrial Cyber
· hxxps://industrialcyber.co/ransomware/china-linked-threat-actor-uat-8837-exploits-sitecore-vulnerability-to-target-north-american-critical-infrastructure/
Sophos
· hxxps://www.sophos.com/en-us/blog/tamperedchef-serves-bad-ads-with-infostealers-as-the-main-course
The Hacker News
hxxps://thehackernews.com/2026/01/china-linked-apt-exploits-sitecore-zero.html
Cisco Talos Blog
· hxxps://blog.talosintelligence.com/uat-8837/
VirusTotal
· hxxps://www.virustotal.com/gui/file/b3f83721f24f7ee5eb19f24747b7668ff96da7dfd9be947e6e24a688ecc0a52b
· hxxps://www.virustotal.com/gui/file/43b0ac119ff957bb209d86ec206ea1ec3c51dd87bebf7b4a649c7e6c7f3756e7
