Risk actors have been exploiting a zero-day vulnerability in legacy Sitecore deployments to deploy WeepSteel reconnaissance malware.
The flaw, tracked below CVE-2025-53690, is a ViewState deserialization vulnerability brought on by the inclusion of a pattern ASP.NET machine key in pre-2017 Sitecore guides.
Some clients reused this key in manufacturing, permitting attackers with data of the important thing to craft legitimate, however malicious ‘_VIEWSTATE’ payloads that tricked the server into deserializing and executing them, resulting in distant code execution (RCE).
The flaw is not a bug in ASP.NET itself, however a misconfiguration vulnerability created by reusing publicly documented keys that had been by no means meant for manufacturing.
Exploitation exercise
Mandiant researchers, who found the malicious exercise within the wild, report that risk actors have been leveraging the flaw in multi-stage assaults.
The attackers goal the ‘/sitecore/blocked. aspx’ endpoint, which accommodates an unauthenticated ViewState subject, and obtain RCE below the IIS NETWORK SERVICE account by leveraging CVE-2025-53690.
The malicious payload they drop is WeepSteel, a reconnaissance backdoor that gathers system, course of, disk, and community info, disguising its exfiltration as normal ViewState responses.
Supply: Mandiant
Mandiant noticed the execution of reconnaissance instructions on compromised environments, together with whoami, hostname, tasklist, ipconfig /all, and netstat -ano.
Within the subsequent stage of the assault, the hackers deployed Earthworm (a community tunneling and reverse SOCKS proxy), Dwagent (a distant entry software), and 7-Zip, which is used to create archives of the stolen information.
Subsequently, they escalated their privileges by creating native administrator accounts (‘asp$,’ ‘sawadmin’), cached (SAM and SYSTEM hives) credentials dumping, and tried token impersonating through GoTokenTheft.
Persistence was secured by disabling password expiration for these accounts, giving them RDP entry, and registering Dwagent as a SYSTEM service.
Supply: Mandiant
Mitigating CVE-2025-53690
CVE-2025-53690 impacts Sitecore Expertise Supervisor (XM), Expertise Platform (XP), Expertise Commerce (XC), and Managed Cloud, as much as model 9.0, when deployed utilizing the pattern ASP.NET machine key included in pre-2017 documentation.
XM Cloud, Content material Hub, CDP, Personalize, OrderCloud, Storefront, Ship, Uncover, Search, and Commerce Server usually are not impacted.
Sitecore revealed a safety bulletin in coordination with Mandiant’s report, warning that multi-instance deployments with static machine keys are additionally in danger.
The advisable actions for probably impacted directors are to instantly exchange all static
Usually, it’s endorsed to undertake common static machine key rotation as an ongoing safety measure.
Extra info on the best way to shield ASP.NET machine keys from unauthorized entry will be discovered right here.
46% of environments had passwords cracked, almost doubling from 25% final yr.
Get the Picus Blue Report 2025 now for a complete take a look at extra findings on prevention, detection, and information exfiltration developments.
