UAT-8837 exploited CVE-2025-53690, a ViewState Deserialization zero-day flaw in Sitecore products for initial access. The threat actor uses compromised credentials or server vulnerabilities to gain access, then performs hands-on-keyboard operations for reconnaissance. They disable RDP RestrictedAdmin to facilitate credential harvesting, execute Windows native commands for host and network reconnaissance, target Active Directory topology and trust relationships, and cycle through open-source tools to evade detection. In at least one case, they exfiltrated a DLL for potential future trojanization and supply-chain attacks.