In April 2025, security researchers identified a sophisticated campaign targeting critical infrastructure networks worldwide through a previously unknown vulnerability in SAP NetWeaver Visual Composer. The vulnerability, tracked as CVE-2025-31324, allows unauthenticated attackers to upload malicious files and gain remote code execution capabilities on affected systems without requiring user authentication or special access privileges. According to their analysis, the server hosted two result files documenting over 581 SAP NetWeaver instances compromised and backdoored with webshells, along with a list of 1,800 domains running SAP NetWeaver marked as potential targets. The attack vector leveraged the “/developmentserver/metadatauploader” API endpoint in SAP NetWeaver to upload malicious webshells, providing attackers with persistent remote access. According to security reports, the compromised SAP systems were connected to industrial control system (ICS) networks, significantly increasing the potential impact of these intrusions. These threat actors are believed to have connections to China’s Ministry of State Security (MSS) or affiliated private entities, operating with strategic objectives to compromise critical infrastructure worldwide. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. EclecticIQ researchers noted the webshells closely resemble Behinder/冰蝎 v3, a toolset commonly used by Chinese-speaking threat actors, providing additional evidence linking the campaign to China-nexus operators. This lightweight backdoor accepts system commands via a parameter named “cmdhghgghhdd” and returns the output directly to the browser, functioning as a fallback access method if the more sophisticated encrypted channel fails. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news. The attacks primarily impacted organizations in the United Kingdom’s natural gas distribution networks, water management utilities, United States medical device manufacturing plants, upstream oil and gas companies, and Saudi Arabian government ministries. Intelligence gathered from exposed attacker infrastructure revealed links to multiple China-nexus Advanced Persistent Threat (APT) groups, including UNC5221, UNC5174, and CL-STA-0048. EclecticIQ analysts identified an openly accessible directory on an attacker-controlled server (15.204.56.106), which contained detailed lists of compromised systems and the tools used in the campaign. Tushar is a Cyber security content editor with a passion for creating captivating and informative content.
This Cyber News was published on cybersecuritynews.com. Publication date: Wed, 14 May 2025 10:25:19 +0000