In April 2025, security researchers discovered a major cyberattack targeting critical infrastructure worldwide. The attackers exploited a previously unknown vulnerability in SAP NetWeaver Visual Composer.
The vulnerability, tracked as CVE-2025-31324, allows attackers to upload malicious files and execute remote code. This can be done without authentication or special privileges.
Global Impact on Critical Sectors
The attacks mainly affected:
- Natural gas distribution networks in the United Kingdom
- Water utilities
- Medical device manufacturing plants in the United States
- Upstream oil and gas companies
- Government ministries in Saudi Arabia
Compromised SAP systems were linked to Industrial Control System (ICS) networks. This connection increased the potential impact of the attacks.
Links to China-Based APT Groups
Investigation revealed links to several China-nexus Advanced Persistent Threat (APT) groups. These included UNC5221, UNC5174, and CL-STA-0048.
Analysts believe these groups are connected to China’s Ministry of State Security (MSS) or affiliated private entities. Their goal is to compromise critical infrastructure around the world.
Evidence from Attacker Infrastructure
Researchers at EclecticIQ found an open directory on an attacker-controlled server (15.204.56.106). This directory contained:
- Lists of compromised SAP systems
- Tools used in the campaign
The server had two files showing over 581 SAP NetWeaver instances were compromised and backdoored with webshells. Another list identified 1,800 SAP domains as potential future targets.
Attack Methodology: Exploiting SAP API Endpoint
The attackers used the “/developmentserver/metadatauploader” API endpoint in SAP NetWeaver. This allowed them to upload malicious webshells and gain persistent remote access.
Two primary webshells were found on victim systems:
- coreasp.jsp
- forwardsap.jsp
Anatomy of the Webshell Payloads
The coreasp.jsp webshell was more advanced. It used obfuscation and encryption to avoid detection.
The webshell accepted system commands through a parameter called “cmdhghgghhdd”. It then returned the output to the attacker’s browser. This served as a fallback access method if other encrypted channels failed.
Links to Behinder/ Toolset
EclecticIQ researchers noted the webshells resembled Behinder/ v3. This toolset is commonly used by Chinese-speaking threat actors. This finding supports the link to China-nexus operators.
