Unmasking UAT-8837: The Zero-Day Exploit That Could Ruin Your Year

A sophisticated China-linked threat actor, identified as UAT-8837, has been observed exploiting a critical zero-day vulnerability in the Sitecore platform. Tracked asCVE-2025-53690, this insecure deserialization flaw allows attackers to bypass authentication and execute remote code (RCE). The primary goal of this campaign is the deployment of the WeepSteel backdoor to facilitate long-term espionage and data exfiltration.

With a CVSS score of 9.0, the vulnerability stems from the use of default or sample ASP.NET machineKey values in Sitecore installations. Due to active exploitation in the wild, CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog.

UAT-8837 is a China-linked advanced persistent threat (APT) group known for targeting high-value enterprise and government sectors. This actor focuses on exploiting public-facing applications to gain a foothold in corporate networks. Unlike financially motivated groups, UAT-8837 prioritizes stealthy reconnaissance and persistent access.

The group’s signature tool in this campaign is WeepSteel. This reconnaissance-focused backdoor is designed for:

• Data Collection: Gathering system configurations and network topology.
• Persistence: Establishing long-term access through custom DLLs.
• Lateral Movement: Staging third-party tools like DWAgent for remote control and Earthworm for network tunneling.

The vulnerability lies in how Sitecore handles ASP.NET ViewState. If a server uses a publicly known or sample machineKey, an attacker can sign a malicious payload that the server trusts as legitimate.

The attack chain employed by UAT-8837 is highly automated and follows a structured path:

1. Initial Access: Attackers target Sitecore endpoints (such as /sitecore/blocked.aspx) with a specially crafted ViewState payload.
2. Exploitation: Because the server utilizes a default machineKey, it validates the malicious signature. This triggers a deserialization flaw, leading to RCE under the IIS NETWORK SERVICE account.
3. Deployment: The WeepSteel backdoor (Information.dll) is dropped into the environment to begin system discovery.
4. Privilege Escalation: UAT-8837 creates new administrative accounts, typically named asp$ or sawadmin, to maintain control.
5. Persistence & Tunneling: The actors install DWAgent as a SYSTEM service and use Earthworm to bypass firewall restrictions.
6. Exfiltration: Sensitive files, including web.config and registry hives, are compressed using 7-Zip and then exfiltrated to the attacker’s controlled infrastructure.

Organizations should monitor their environments for the following artifacts:

• Unauthorized Accounts: Look for local admins named asp$ or sawadmin.
• Suspicious Processes: Presence of dwagent.exe, ew.exe (Earthworm), or unexpected 7z.exe activity.
• File Artifacts: Information.dll or other unsigned DLLs in Sitecore web directories.
• Registry Activity: Unexpected exports of HKEY_LOCAL_MACHINE\SAM or SYSTEM.
• Network Traffic: Unusual outbound connections to unknown IPs from the Sitecore web server.

1. Update machineKey: Immediately replace any default or sample <machineKey> values in your web.config with unique, cryptographically strong keys.
2. Upgrade Sitecore: Transition to Sitecore versions beyond 9.0 and apply all security hardening guides (KB1003865).
3. Account Auditing: Scan for and delete the asp$ and sawadmin accounts if they appear in your local users list.
4. Endpoint Protection: Implement EDR policies to block the execution of unauthorized tunneling tools like Earthworm and DWAgent.
5. Restrict RDP: Limit RDP access to known management workstations and use Multi-Factor Authentication (MFA).

Saner patch management is a continuous, automated, and integrated software that instantly fixes risks exploited in the wild. The software supports major operating systems like Windows, Linux, and macOS, as well as 550+ third-party applications.

It also allows you to set up a safe testing area to test patches before deploying them in a primary production environment. Saner patch management additionally supports a patch rollback feature in case of patch failure or a system malfunction.

Experience the fastest and most accurate patching software here.