Forescout Vedere Labs security researchers have also linked these ongoing attacks to a Chinese threat actor they track as Chaya_004, while EclecticIQ reported on Tuesday that three other Chinese APTs (i.e., UNC5221, UNC5174, and CL-STA-0048) are also targeting NetWeaver instances unpatched against CVE-2025-31324. Ransomware gangs have joined ongoing SAP NetWeaver attacks, exploiting a maximum-severity vulnerability that allows threat actors to gain remote code execution on vulnerable servers. In the RansomEXX attacks, the threat actors deployed the gang's PipeMagic modular backdoor and exploited the CVE-2025-29824 Windows CLFS vulnerability abused in previous incidents linked to this ransomware operation. Based on exposed files found in an openly accessible directory on one of these attackers' unsecured servers, Forescout says they've backdoored at least 581 SAP NetWeaver instances (including critical infrastructure in the United Kingdom, the United States, and Saudi Arabia) and are planning to target another 1,800 domains. ReliaQuest linked BianLian to at least one incident with "moderate confidence" based on an IP address used by the ransomware gang's operators in the past to host one of their command-and-control (C2) servers. "Continued analysis has uncovered evidence suggesting involvement from the Russian ransomware group 'BianLian' and the operators of the 'RansomEXX' ransomware family (tracked by Microsoft as 'Storm-2460')," the cybersecurity firm said. Today, in an update to their original advisory, ReliaQuest revealed that the RansomEXX and BianLian ransomware operations have also joined these attacks. CISA added the CVE-2025-31324 flaw to its Known Exploited Vulnerabilities Catalog two weeks ago, mandating federal agencies to secure their servers by May 20, as required by Binding Operational Directive (BOD) 22-01. "Persistence backdoor access to these systems provides a foothold for China-aligned APTs, potentially enabling strategic objectives of the People’s Republic of China (PRC), including military, intelligence, or economic advantage," Forescout said. On Monday, SAP has also patched a second NetWeaver vulnerability (CVE-2025-42999) chained in these attacks as a zero-day as early as March to execute arbitrary commands remotely.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Wed, 14 May 2025 17:40:19 +0000