Attackers Exploit Sitecore Zero Day

Attackers exploited a now-patched zero-day vulnerability in a popular content management system that powers websites for companies including HSBC, L’Oréal, Toyota and United Airlines.

See Also: OnDemand | Cryptographic Control in a Zero Trust World: Mastering Machine-to-Machine Trust

Sitecore told customers Tuesday that attackers used a cryptography key stored in some deployments to force the system into loading malware. The key has been documented in publicly available Sitecore guidance published since at least 2017 and was meant to be used only as a sample.

Sitecore uses the Microsoft-developed ASP.NET web-application framework to construct dynamic webpages. It relies on an underlying ASP.NET function known as ViewState to persist connections between users and webpages as a way of overcoming the web’s otherwise stateless condition. ASP.NET uses encryption to protect data transmitted in session cookies.

Researchers from Google Mandiant spotted attackers using the sample key to force the Sitecore system of unidentified customers to deserialize an embedded .NET assembly reconnaissance tool the threat intel company tracks as “Weepsteel.” Attackers sent a malicious payload attached to the sample key – a copy of which researchers said could be found in the ASP.NET configuration file web.config – to a web-exposed component embedded in Sitecore deployments. Attackers counted on the ViewState function to accept the sample key and unpack the malicious code into server memory. The exposed web function did not require authentication to access it.

“When machine keys (which protect ViewState integrity and confidentiality) are compromised, the application effectively loses its ability to differentiate between legitimate and malicious ViewState payloads sent to the server,” Mandiant researchers wrote.

The vulnerability is tracked as CVE-2025-53690.

Attackers used Weepsteel to collected system, user and network details and exfiltrated those details disguised as benign ViewState responses.

Following reconnaissance, attackers archived critical application files, likely in a bid to contain sensitive files such as web.config, which contains elements such as authentication and authorization settings. They staged tools in a public directory such as Earthworm, a tunneling utility; Dwagent, a remote access tool; and Sharphound, an Active Directory reconnaissance tool. By escalating privileges through newly created local administrator accounts, the threat actors dumped the Security Account Manager database files to harvest cached credentials.

Attackers executed a token-stealing tool known as GoTokenTheft. They maintained persistence by disabling password expiration policies, installing remote access agents and routing traffic through covert tunnels. Ultimately, they removed temporary accounts once administrator credentials were compromised, shifting toward more covert access methods.

Mandiant and Sitecore recommend customers rotate machine keys, enable ViewState Message Authentication Code validation and encrypt plaintext secrets within configuration files. Organizations should also monitor for suspicious account creation, RDP activity and tunneling traffic associated with Earthworm or Dwagent.