UAT-8837Threat actor
UAT-8837 is a sophisticated China-linked APT group exploiting critical zero-day vulnerabilities, such as CVE-2025-53690 in the Sitecore platform, to achieve remote code execution and deploy the WeepSteel backdoor for espionage and data exfiltration.From MISP Galaxy
Last reported 27 days ago, by CERT-EU1 report
Suspected originChinaMISP Galaxy
ATT&CK techniques
1 technique · each with the sentence it comes from- T1684Social Engineering
“The attackers used fake Booking.com reservation cancellations, social engineering with simulated blue screens of death (BSODs), and trusted MSBuild.exe abuse to deploy DCRat for remote access and secondary payload delivery.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
Cyber Brief 26-02 - January 2026“China-linked UAT-8837 targets critical infrastructure in North America via zero-day and n-day exploitation”
Thanks — we review every report.