China-Linked APT Exploits Sitecore Zero-Day in Attacks on American Critical Infrastructure

According to Cisco Talos, which is tracking the activity under the name UAT-8837, a China-nexus advanced persistent threat has been observed targeting critical infrastructure sectors in North America since at least last year. The group is described as primarily tasked with obtaining initial access to high-value organisations, using either exploitation of vulnerable servers or compromised credentials.

After gaining access, UAT-8837 predominantly deploys open-source tools to harvest credentials, security configurations and AD information to create multiple channels of access. The most recent activity involved exploiting a critical zero‑day vulnerability in Sitecore (CVE-2025-53690, CVSS 9.0) to obtain initial access, with post‑exploitation tactics overlapping with a Google‑owned Mandiant campaign from September 2025.

Once inside, the group conducts reconnaissance, disables RestrictedAdmin for RDP, and uses a range of tools such as GoTokenTheft, EarthWorm, DWAgent, SharpHound, Impacket, GoExec, Rubeus and Certipy to enable persistence and information collection. Researchers noted that UAT-8837 exfiltrated DLL-based shared libraries, raising concerns about potential supply chain compromises and future trojanisation.