Attackers snooping around Sitecore, dropping malware via public sample keys

Multiple Sitecore products are potentially impacted by CVE-2025-53690 — a ViewState deserialization/configuration issue where publicly documented machine keys enabled remote code execution. Attackers exploited exposed instances to deploy WEEPSTEEL (information-gathering malware), archive web application files (likely to obtain web.config), escalate privileges, and attempt lateral movement; Mandiant disrupted the attack and CISA added the CVE to its Known Exploited Vulnerabilities catalog.