Zero-Day Threat: UAT-8837 Targets North American Infrastructure

A Cisco Talos-identified campaign, named UAT-8837, is reportedly targeting critical infrastructure in North America with an arsenal of open-source tools and potential zero-day exploits, according to Cisco Talos. The group is assessed with “medium confidence” to be a China-nexus Advanced Persistent Threat actor and has focused on North American critical infrastructure since at least 2025.

They have demonstrated the ability to exploit cutting-edge vulnerabilities, and the report notes a link to CVE-2025-53690, a ViewState deserialization zero-day in SiteCore products, suggesting they may have access to zero-day exploits. Once inside a network, UAT-8837 pivots to a living-off-the-land strategy mixed with open-source utilities to blend in with normal traffic and evade detection.

Their toolkit includes Earthworm, GoToken Theft, SharpHound, Certipy and GoExec, with operators cycling through versions to bypass security products. The group exfiltrates DLL-based shared libraries and has been observed creating backdoored user accounts and disabling security features to enable lateral movement, a pattern that raises concerns about potential supply chain compromises for downstream customers. according to Cisco Talos