UAT-8837
- Origin
- CN
- Primary motivation
- espionage
- Sophistication
- advanced
- Resource level
- government
- Actor type
- nation-state
- Last IoC activity
- 2026-06-17 04:21:05
- Profile updated
- 2026-07-07 12:23:18
Targeted industries: government-and-public-sector technology-and-telecommunications defense-and-aerospace financial-services
Context
UAT-8837 is a sophisticated China-linked APT group exploiting critical zero-day vulnerabilities, such as CVE-2025-53690 in the Sitecore platform, to achieve remote code execution and deploy the WeepSteel backdoor for espionage and data exfiltration. The group targets high-value enterprise and government sectors, focusing on public-facing applications to gain initial access and conducting stealthy reconnaissance. UAT-8837 employs techniques like privilege escalation by creating administrative accounts and is linked to targeted intrusions aimed at credential harvesting and internal reconnaissance.
Exploited vulnerabilities
- CVE-2025-53690 (vulnerability)
Reports & references
- Cisco Talos — Uat 8837 (report)