Chinese hackers targeting ‘high value’ North American critical infrastructure, Cisco says

Chinese hackers successfully breached multiple critical infrastructure organizations in North America over the last year using a combination of compromised credentials and exploitable servers, researchers at Cisco Talos found. 

In findings published Thursday, the researchers documented a campaign starting last year where Chinese government-backed hacking groups were tasked with obtaining initial access to “high-value” organizations. Cisco Talos refers to the group as “UAT-8837.”

After getting access, the threat actors used a variety of tools to steal credentials, security configurations and other information to enable broader access to victim organizations. 

While the group has used multiple vulnerabilities to gain access, Cisco Talos tracked several intrusions involving the exploitation of CVE-2025-53690 — a bug affecting products from software company SiteCore.

The zero-day vulnerability was spotlighted by federal cybersecurity officials in the Fall, and all…