Full Report
Cisco Talos is closely tracking UAT-8837, a threat actor we assess with medium confidence is a China-nexus advanced persistent threat (APT) actor.
Analysis Summary
# Threat Actor: UAT-8837
## Attribution & Identity
* **Identification:** Threat actor UAT-8837.
* **Assessment:** Assessed with **medium confidence** as a **China-nexus Advanced Persistent Threat (APT) actor**. This assessment is based on overlaps in Tactics, Techniques, and Procedures (TTPs) with other known China-nexus threat actors.
* **Primary Goal (High Level):** Primarily tasked with obtaining initial access to high-value organizations.
## Activity Summary
UAT-8837 has been active since at least 2025, focusing its targeting efforts on organizations within **critical infrastructure sectors** in **North America**. The group gains initial access via successful exploitation of vulnerable servers (both n-day and zero-day) or by using already compromised credentials. After initial access, they conduct reconnaissance and deploy open-source tools to harvest sensitive information, including credentials, security configurations, and domain/Active Directory (AD) information to establish persistent access channels.
## Tactics, Techniques & Procedures
* **Initial Access:** Exploitation of vulnerable servers, including exploitation of **CVE-2025-53690** (a ViewState Deserialization zero-day in SiteCore products).
* **Reconnaissance:** Execution of common network and system checks:
* `ping google[.]com`
* `tasklist /svc`
* `netstat -aon -p TCP`
* `whoami`
* `quser`
* `hostname`
* `net user`
* **Credential/Access Manipulation:** Disabling **RestrictedAdmin for Remote Desktop Protocol (RDP)** via: `REG ADD HKLM\System\CurrentControlSet\Control\Lsa /v DisableRestrictedAdmin /t REG_DWORD /d 00000000 /f`.
* **Lateral Movement/Persistence:** Utilizing tools for tunneling, credential theft, and remote administration.
* **Staging:** Downloading and storing artifacts predominantly in:
* `C:\Users\<User>\Desktop\`
* `C:\windows\temp\`
* `C:\windows\public\music\`
* **Tool Cycling:** The actor frequently cycles through variants of tools (e.g., Earthworm) to evade detection by endpoint protection products.
## Targeting
* **Sectors:** Critical Infrastructure sectors.
* **Geography:** North America.
* **Victims:** High-value organizations within the identified sectors.
## Tools & Infrastructure
* **Exploits Used:** CVE-2025-53690 (Zero-day in SiteCore).
* **Post-Compromise Tools:**
* **Earthworm:** Network tunneling tool used to expose internal endpoints to C2 infrastructure.
* **SharpHound:** Used for collecting Active Directory information.
* **DWAgent:** Remote administration tool used to access endpoints and deploy additional malware.
* **Certipy:** Used in post-compromise activity.
* **GoTokenTheft:** Utility for stealing access tokens (deployed as `go.exe`).
* **GoExec**
* **SharpWMI**
* **Rubeus**
* **Impacket** (Likely for post-exploitation tasks).
* **Infrastructure (C2 Examples):**
* `172[.]188[.]162[.]183` (Used with Earthworm for tunneling on ports 1433, 443)
* `4[.]144[.]1[.]47` (Used with Earthworm on port 448)
* `74[.]176[.]166[.]174` (Used with Earthworm on port 443)
* `20[.]200[.]129[.]75` (Used with Earthworm on port 443)
## Implications
UAT-8837 is a sophisticated APT actor capable of leveraging zero-day vulnerabilities to gain initial access to sensitive environments. Their focus on critical infrastructure combined with the established goal of gathering credentials and AD information suggests a persistent espionage mission aimed at mapping and maintaining long-term access to high-value North American networks. Their reliance on widely used open-source tools, along with custom staging and tunneling techniques (Earthworm), makes detection challenging for organizations relying solely on signature-based defenses.
## Mitigations
* **Vulnerability Management:** Prioritize patching for known vulnerabilities, especially those affecting external-facing infrastructure (e.g., SiteCore instances, given the recent zero-day activity).
* **Network Monitoring:** Monitor for internal C2 communication patterns, specifically reverse tunneling over standard ports using tools like Earthworm.
* **Endpoint Detection & Response (EDR):** Employ advanced EDR solutions capable of monitoring for suspicious process command lines, especially regarding the disabling of security features like RestrictedAdmin over RDP.
* **Active Directory Security:** Implement rigorous monitoring and auditing of AD configuration changes, particularly related to RDP settings and the execution of enumeration tools like SharpHound.
* **Privilege Control:** Strictly limit the ability of non-administrative accounts to execute or utilize GoTokenTheft or similar token manipulation utilities.