Risk actors have been exploiting a zero-day vulnerability in legacy Sitecore deployments to deploy WeepSteel reconnaissance malware.
The flaw, tracked beneath CVE-2025-53690, is a ViewState deserialization vulnerability brought on by the inclusion of a pattern ASP.NET machine key in pre-2017 Sitecore guides.
Some prospects reused this key in manufacturing, permitting attackers with data of the important thing to craft legitimate, however malicious ‘_VIEWSTATE’ payloads that tricked the server into deserializing and executing them, resulting in distant code execution (RCE).
The flaw is not a bug in ASP.NET itself, however a misconfiguration vulnerability created by reusing publicly documented keys that had been by no means meant for manufacturing.
Exploitation exercise
Mandiant researchers, who found the malicious exercise within the wild, report that risk actors have been leveraging the flaw in multi-stage assaults.
The attackers goal the ‘/sitecore/blocked. aspx’ endpoint, which incorporates an unauthenticated ViewState discipline, and obtain RCE beneath the IIS NETWORK SERVICE account by leveraging CVE-2025-53690.
The malicious payload they drop is WeepSteel, a reconnaissance backdoor that gathers system, course of, disk, and community data, disguising its exfiltration as normal ViewState responses.
Supply: Mandiant
Mandiant noticed the execution of reconnaissance instructions on compromised environments, together with whoami, hostname, tasklist, ipconfig /all, and netstat -ano.
Within the subsequent stage of the assault, the hackers deployed Earthworm (a community tunneling and reverse SOCKS proxy), Dwagent (a distant entry software), and 7-Zip, which is used to create archives of the stolen knowledge.
Subsequently, they escalated their privileges by creating native administrator accounts (‘asp$,’ ‘sawadmin’), cached (SAM and SYSTEM hives) credentials dumping, and tried token impersonating by way of GoTokenTheft.
Persistence was secured by disabling password expiration for these accounts, giving them RDP entry, and registering Dwagent as a SYSTEM service.
Supply: Mandiant
Mitigating CVE-2025-53690
CVE-2025-53690 impacts Sitecore Expertise Supervisor (XM), Expertise Platform (XP), Expertise Commerce (XC), and Managed Cloud, as much as model 9.0, when deployed utilizing the pattern ASP.NET machine key included in pre-2017 documentation.
XM Cloud, Content material Hub, CDP, Personalize, OrderCloud, Storefront, Ship, Uncover, Search, and Commerce Server aren’t impacted.
Sitecore revealed a safety bulletin in coordination with Mandiant’s report, warning that multi-instance deployments with static machine keys are additionally in danger.
The really useful actions for doubtlessly impacted directors are to instantly exchange all static <machineKey> values in net.config with new, distinctive keys, and make sure the <machineKey> ingredient inside net.config is encrypted.
Normally, it is strongly recommended to undertake common static machine key rotation as an ongoing safety measure.
Extra data on easy methods to shield ASP.NET machine keys from unauthorized entry will be discovered right here.
46% of environments had passwords cracked, practically doubling from 25% final 12 months.
Get the Picus Blue Report 2025 now for a complete take a look at extra findings on prevention, detection, and knowledge exfiltration developments.