{
  "name": "Targets critical infrastructure sectors in North America",
  "slug": "targets-critical-infrastructure-sectors-in-north-america",
  "description": "UAT-8837, assessed as a China-nexus advanced persistent threat actor, has been targeting critical infrastructure sectors in North America since 2025. The group exploits vulnerabilities, including zero-days, to gain initial access and deploys open-source tools for reconnaissance, credential harvesting, and lateral movement. Their toolkit includes GoTokenTheft, Earthworm, DWAgent, SharpHound, Impacket, GoExec, Rubeus, and Certipy. UAT-8837 conducts extensive domain and Active Directory reconnaissance, creates backdoor accounts, and exfiltrates sensitive data. The actor's focus on obtaining initial access to high-value organizations and their use of sophisticated tools and techniques indicate a significant threat to critical infrastructure sectors.",
  "published": "2026-01-16T12:31:45+00:00",
  "created_at": "2026-01-16T12:31:45+00:00",
  "modified_at": "2026-01-16T12:43:46+00:00",
  "created_at_opencti": "2026-01-16T12:31:45+00:00",
  "author": "",
  "confidence": null,
  "report_types": [],
  "labels": [],
  "tags": [
    "2026-01-16",
    "CVE-2025-53690",
    "active directory",
    "apt",
    "certipy",
    "china-nexus",
    "credential harvesting",
    "critical-infrastructure",
    "dwagent",
    "earthworm",
    "goexec",
    "gotokentheft",
    "impacket",
    "lateral movement",
    "rubeus",
    "sharphound",
    "zero-day"
  ],
  "related_entities": {
    "observables": [
      {
        "id": "",
        "name": "891246a7f6f7ba345f419404894323045e5725a2252c000d45603d6ddf697795"
      },
      {
        "id": "",
        "name": "b3f83721f24f7ee5eb19f24747b7668ff96da7dfd9be947e6e24a688ecc0a52b"
      },
      {
        "id": "",
        "name": "42e3ad56799fbc8223fb8400f07313559299496bb80582a6cbae29cb376d96c3"
      },
      {
        "id": "",
        "name": "4af156b3285b49485ef445393c26ca1bb5bfe7cdc59962c5c5725e3f3c574f7c"
      },
      {
        "id": "",
        "name": "b7ecd4ff75c0e3ed196e1f53d92274b1e94f17fa6c39616ce0435503906e66fb"
      },
      {
        "id": "",
        "name": "74e68b4e07d72c9b8e0bc8cbfd57f980b4a2cd9d27c37bb097ca4fb2108706e3"
      },
      {
        "id": "",
        "name": "6e8af5c507b605a16373e8453782bfd8a3ec3bd76f891e71a159d8c2ff2a5bb0"
      },
      {
        "id": "",
        "name": "5391f69425217fa8394ebac0d952c5a3d1f0f5ac4f20587978cd894fdb6199cd"
      },
      {
        "id": "",
        "name": "451e03c6a783f90ec72e6eab744ebd11f2bdc66550d9a6e72c0ac48439d774cd"
      },
      {
        "id": "",
        "name": "6d20371b88891a1db842d23085a0253e36cf3bf0691aee2ae15a66fc79f3803d"
      },
      {
        "id": "",
        "name": "1b3856e5d8c6a4cec1c09a68e0f87a5319c1bd4c8726586fd3ea1b3434e22dfa"
      },
      {
        "id": "",
        "name": "de9c13b1abeab11626a8edc1385df358d549a65e8cc7a69baca84cd825acc8e7"
      },
      {
        "id": "",
        "name": "1c5174672bf2ccedb6a426336ca79fd326e61cd26dd9ae684b8ffd0b5a70c700"
      },
      {
        "id": "",
        "name": "194ca1b09902ceaaa8a7e66234be9dc8a12572832836361f49f1074eae861794"
      },
      {
        "id": "",
        "name": "51d6448e886521aaaaf929a50763156ceb99ede587c65de971700a5583d6a487"
      },
      {
        "id": "",
        "name": "e27e6e8e97421593f1e8d66f280e894525e22b373248709beaf81dc6107fb88d"
      },
      {
        "id": "",
        "name": "4f7518b2ee11162703245af6be38f5db50f92e65c303845ef13b12c0f1fc2883"
      },
      {
        "id": "",
        "name": "1de72bb4f116e969faff90c1e915e70620b900e3117788119cffc644956a9183"
      },
      {
        "id": "",
        "name": "4d47445328bfd4db12227af9b57daab4228244d1325cba572588de237f7b2e98"
      },
      {
        "id": "",
        "name": "8bf233f608ea508cd6bf51fb23053d97aa970b8d11269d60ce5c6e113e8e787a"
      },
      {
        "id": "",
        "name": "887817fbaf137955897d62302c5d6a46d6b36cb34775e4693e30e32609fb6744"
      },
      {
        "id": "",
        "name": "ced14e8beb20a345a0d6f90041d8517c04dbc113feff3bc6e933968d6b846e31"
      },
      {
        "id": "",
        "name": "5090f311b37309767fb41fa9839d2770ab382326f38bab8c976b83ec727e6796"
      },
      {
        "id": "",
        "name": "fab292c72ad41bae2f02ae5700c5a88b40a77f0a3d9cbdf639f52bc4f92bb0a6"
      },
      {
        "id": "",
        "name": "4e8304040055d3bffcb3551873da45f66577723d1a975416a49afa5aec4eb295"
      },
      {
        "id": "",
        "name": "d0beb6184ea4402c39e257d5912c7ace3607e908e76127014e3ec02866b6d70c"
      },
      {
        "id": "",
        "name": "bdf7b28df19b6b634c05882d9f1db73f63252f855120ed3e4da4e26f2c6190e8"
      },
      {
        "id": "",
        "name": "2f295f0cedc37b0e1ea22de9d8cb461fa6f84ab0673fde995fd0468a485ddb59"
      },
      {
        "id": "",
        "name": "8bc008a621c5e3068129916770d24ee1d7d48079ee42797f86d3530ca90e305c"
      }
    ],
    "malware": [
      {
        "id": "8e6bc123-8c9d-40de-a11c-4d0c404e91fe",
        "name": "Earthworm",
        "slug": "earthworm"
      },
      {
        "id": "b2a588c4-1e78-41e3-b6c2-21cdac752d10",
        "name": "Impacket",
        "slug": "impacket"
      },
      {
        "id": "df9944d0-c5a1-4412-b240-023df5e283e2",
        "name": "GoTokenTheft",
        "slug": "gotokentheft"
      },
      {
        "id": "8b840132-0833-4387-8df5-71fb46f18e17",
        "name": "GoExec",
        "slug": "goexec"
      },
      {
        "id": "beb98701-36d2-4c94-9e89-85dea2077719",
        "name": "Rubeus",
        "slug": "rubeus"
      },
      {
        "id": "5abc5264-29fa-4ebf-aa63-f6ae63608864",
        "name": "DWAgent",
        "slug": "dwagent"
      },
      {
        "id": "75b7770f-c782-4046-b9ae-c88214675363",
        "name": "SharpHound",
        "slug": "sharphound"
      },
      {
        "id": "242f9a15-3e4a-4a2b-8c8a-8736cbd6e114",
        "name": "Certipy",
        "slug": "certipy"
      }
    ],
    "intrusion_sets": [
      {
        "id": "a84c7a36-0746-476d-b966-270435398803",
        "name": "UAT-8837",
        "slug": "uat-8837"
      }
    ],
    "attack_patterns": [
      {
        "id": "c473a756-355a-42ad-a0df-cd3a8fa006d1",
        "name": "T1057"
      },
      {
        "id": "9f11a241-9abc-4c57-95dd-33955ab08826",
        "name": "T1078"
      },
      {
        "id": "c9de6d3f-08cf-448d-8b9f-9aeff59fc48f",
        "name": "T1550"
      },
      {
        "id": "dc17cbbd-40d8-43cf-b3cf-50d1276db2c7",
        "name": "T1016"
      },
      {
        "id": "6c8f8a40-2746-4a37-86bd-81e82afa6e62",
        "name": "T1190"
      },
      {
        "id": "cbd87c8c-3bed-461a-acef-56ffc8b87571",
        "name": "T1105"
      },
      {
        "id": "41ad5d62-aa6a-47d6-a9a9-fb2209601099",
        "name": "T1098"
      },
      {
        "id": "b9eab970-53dd-4977-9a26-c4fe566e422d",
        "name": "T1133"
      },
      {
        "id": "6efb8bea-11d7-418d-a429-9f4a3e6c50f6",
        "name": "T1087"
      },
      {
        "id": "5b7c66d1-0466-4ba7-af6f-eb82c2f9d05b",
        "name": "T1033"
      },
      {
        "id": "45082a8e-9c79-470e-ad1b-decac7188e8f",
        "name": "T1083"
      },
      {
        "id": "70616b2f-4019-4963-b758-5d9f6f20e201",
        "name": "T1082"
      }
    ],
    "vulnerabilities": [
      {
        "id": "",
        "name": "CVE-2025-53690"
      }
    ],
    "others": [
      {
        "id": "",
        "name": "Energy"
      },
      {
        "id": "",
        "name": "Manufacturing"
      },
      {
        "id": "",
        "name": "Defense"
      },
      {
        "id": "",
        "name": "Government"
      }
    ]
  },
  "external_refs": [
    "https://otx.alienvault.com/pulse/696a3dc15e8d8c495dbd889b",
    "https://blog.talosintelligence.com/uat-8837/"
  ]
}