China-linked APT UAT-8837 targets North American critical infrastructure

According to Cisco Talos, a China-linked threat group tracked as UAT-8837 has targeted North American critical infrastructure since at least last year, with activity showing tactics, techniques and procedures that overlap with other China-nexus clusters. The researchers say UAT-8837 is a China-nexus APT actor, based on those overlaps, and that since at least 2025 the group has focused on critical infrastructure sectors in North America.

After gaining access via exploits or stolen credentials, the group uses open-source tools to steal credentials, map AD environments, maintain access, and conduct hands-on attacks, with evidence of a zero-day exploit. Their post‑initial access toolkit includes GoTokenTheft, EarthWorm, DWAgent, SharpHound, Impacket, GoExec, Rubeus, and Certipy, used to enumerate, exfiltrate and privilege‑escalate within targets.

Researchers note that UAT-8837 has run commands to steal credentials and sensitive data and has exfiltrated product‑related DLLs, raising risks of trojanization and future supply‑chain attacks, while Talos also published Snort Rules and IOCs to detect the activity.