Hackers exploited Sitecore zero-day flaw to deploy backdoors

Threat actors have been exploiting a zero-day vulnerability in legacy Sitecore deployments to deploy WeepSteel reconnaissance malware, with CVE-2025-53690 described as a ViewState deserialization flaw caused by a sample ASP.NET machine key in pre-2017 Sitecore guides.

Mandiant researchers, who discovered the activity in the wild, report that the attackers are using multi-stage attacks targeting the unauthenticated ViewState field at the '/sitecore/blocked.aspx' endpoint to achieve remote code execution under the IIS NETWORK SERVICE account. The dropped payload, WeepSteel, collects system, process, disk and network information and hides its exfiltration within normal ViewState responses.

In the subsequent stages, the attackers deploy Earthworm, a network tunnelling and reverse SOCKS proxy, and Dwagent, a remote access tool, before archiving stolen data with 7-Zip. They also escalate privileges by creating local administrator accounts, dumping cached credentials, and attempting token impersonation, with persistence secured by enabling RDP access and registering Dwagent as a SYSTEM service, according to Mandiant. Sitecore published a security bulletin with guidance to replace static machine keys and encrypt the machineKey in web.config as a precaution.