A China-nexus advanced persistent threat (APT), tracked as UAT-8837 by Cisco Talos, has been observed targeting critical infrastructure sectors in North America since at least 2025. The actor is believed to focus on initial access to high-value organizations and exfiltration of sensitive data.
“After obtaining initial access either via exploited servers or compromised credentials , UAT-8837 predominantly deploys open-source tools to harvest credentials, AD data, and system configurations,” Talos researchers noted.
Zero-Day Exploits
The Zero-Day Threat Group, UAT-8837, took advantage of an extremely critical Sitecore vulnerability (CVE-2025-53690 with a CVSS base score of 9) to create backdoors into compromised networks. This type of attack has been previously reported by Mandiant in their report dated September 2022. Based on these similarities, we believe with a high degree of confidence that the attack group has access to advanced toolsets and likely to use Zero-Day exploits to gain access to their target networks.
Once they were in, the actor immediately disabled the RestrictedAdmin configuration setting on the RDP connection before opening a command window to run other additional actions. The actor then went on to complete multiple steps of activity:
1. Using GoTokenTheft to steal tokens from connected user accounts.
2. Using EarthWorm to create reverse SOCKS channels for use later on.
3. Using DWAgent to maintain access and perform reconnaissance against AD.
4. Using SharpHound to enumerate Active Directory.
5. Using Impacket to issue commands as an elevated user.
6. Using GoExec to run commands on other devices connected to the network.
7. Using Rubeus to log on or disrupt services as a service account.
8. Using Certipy to discover Active Directory Servers.
According to Talos, UAT-8837 may have exfiltrated the DLLs of the compromised organizations and possibly left the door open for future supply chain intrusion or reverse engineering of these products.
Far-Reaching Consequences for Critical Infrastructure
Perceptions of potential sovereign attacks by China on CNI and OT have heightened awareness on the capabilities of actors targeting our CNI/Microgrid's Operational Technology. Several governments in Australia, Germany, Netherlands, New Zealand, UK, and USA issued security advisories on the potential threat of exposed OT risk.
Recommended actions include:
1. Centralize exposed OT connections/limit access to exposed OT.
2. Implement secure and encrypted OT connectivity with validated/strengthened OT perimeters.
3. Assess, monitor and log all OT connectivity.
4. Decommission old OT equipment potentially exposing CNI participants to a range of exploitation opportunities.
According to many agencies, both opportunistic and highly developed actors have targeted exposed insecure "OT" connectivity and will continue to exploit these vulnerabilities to increase their impact through the existence of state-supported cyber campaigns and hacktivism.
Key Takeaways
1. UAT-8837 is a clear indication that APT Actors continue to utilize unpatched vulnerabilities (zero days) as well as methods to steal Credentials, as well as open source tools & utilities to facilitate lateral movement & access persistence.
2. The exfiltration of sensitive and Proprietary Dynamic Link Libraries (DLLs) significantly increases Supply Chain risk.
3. In order to mitigate both Opportunistic & Sophisticated threats, organizations that manage Critical Infrastructure should take a holistic approach to OT Security by implementing and maintaining an OT Security Framework.
Source: The Hacker News
