Sitecore Zero-Day Powers Reconnaissance Malware

Sitecore Zero-Day Exploited to Deliver Reconnaissance Malware

Summary

In September 2025, a critical zero-day vulnerability CVE-2025-53690 was discovered in Sitecore Experience Manager (XM), Experience Platform (XP), Experience Commerce (XC), and Managed Cloud. The flaw, caused by ViewState deserialization of untrusted data, is being actively exploited in the wild.

Threat actors are abusing this hidden weakness to deliver the WEEPSTEEL reconnaissance malware, which stealthily maps environments, extracts configuration files, and targets Active Directory. With the use of fake admin accounts, tunneling utilities, and persistence tools, attackers have escalated privileges to full domain control. This campaign highlights how legacy Sitecore deployments are at highest risk, especially those without unique machine keys.

Vulnerability Details

• CVE-2025-53690 (Deserialization of Untrusted Data)

  • CWE-502: Dangerous deserialization flaw in Sitecore’s ViewState mechanism.

  • Affects Sitecore XM, XP (through v9.0), XC, and Managed Cloud (AD version 1.4 and earlier).

  • Attackers send malicious HTTP requests targeting hidden ViewState forms in legitimate Sitecore components.

  • Exploitation often leaves traces in event logs as “ViewState verification failed” errors.

Intrusion Chain:

1. Malicious payloads decrypted on vulnerable servers load the WEEPSTEEL .NET assembly.

2. WEEPSTEEL gathers host, user, and network details and exfiltrates them via hidden __VIEWSTATE fields in HTTP POST requests.

3. Attackers escalate privileges by creating fake admin accounts (e.g., asp$, sawadmin), enabling RDP access, password hash theft, and registry dumps.

4. Additional tools are deployed, including EARTHWORM (reverse SOCKS tunneler), DWAGENT (persistence), and utilities like main.exe and GoToken.exe.

5. Attackers pivot into Active Directory reconnaissance using SharpHound to map AD trust relationships.

6. Finally, temporary admin accounts are deleted to cover tracks, leaving victims exposed to long-term compromise.

Recommendations

• Update Sitecore Immediately: Upgrade to the latest builds where unique machine keys are auto-generated.

• Rotate Keys and Credentials: Assume compromise, reset machine keys, and change admin/service account passwords.

• Audit for Malicious Artifacts: Search for fake admin accounts (asp$, sawadmin), suspicious tools (dwagent.exe, main.exe, EARTHWORM).

• Monitor AD & Logs: Track RDP sessions, privilege changes, password resets, and unusual log entries (esp. ViewState errors).

• Strengthen Vulnerability Management: Maintain an updated inventory of software, apply patches promptly, and review vendor security practices.

Indicators of Compromise (IoCs)

MD5 Hashes

• 117305c6c8222162d7246f842c4bb014

• a39696e95a34a017be1435db7ff139d5

• f410d88429b93786b224e489c960bf5c

• be7e2c6a9a4654b51a16f8b10a2be175

• 62483e732553c8ba051b792949f3c6d0

• 63d22ae0568b760b5e3aabb915313e44

SHA256 Hashes

• a566cceaf9a66332470a978a234a8a8e2bbdd4d6aa43c2c75c25a80b3b744307

• b3f83721f24f7ee5eb19f24747b7668ff96da7dfd9be947e6e24a688ecc0a52b

• 61f897ed69646e0509f6802fb2d7c5e88c3e3b93c4ca86942e24d203aa878863

IPv4:Port

• 130[.]33[.]156[.]194[:]443

• 130[.]33[.]156[.]194[:]8080

• 103[.]235[.]46[.]102[:]80

MITRE ATT&CK TTPs

• Initial Access: T1190 (Exploit Public-Facing Applications)

• Execution: T1059 (Command & Scripting Interpreter), T1059.005 (Visual Basic), T1203 (Exploitation for Client Execution)

• Persistence: T1136 (Create Account), TA0003

• Privilege Escalation: T1068 (Exploitation for Privilege Escalation)

• Defense Evasion: T1027 (Obfuscation), T1070 (Indicator Removal), T1036 (Masquerading)

• Discovery: T1082 (System Information Discovery), T1071 (Application Layer Protocol)

• Lateral Movement: T1021.001 (Remote Desktop Protocol)

• Command & Control: T1090 (Proxy), T1105 (Ingress Tool Transfer), T1071.001 (Web Protocols)

• Exfiltration: T1041 (Exfiltration over C2 Channel)

• Resource Development: T1588 (Obtain Capabilities), T1588.006 (Vulnerabilities)

References

• Google Cloud – ViewState Deserialization Zero-Day

• Sitecore Knowledge Base – Security Advisory