Hackers Exploit SAP Vulnerability to Target U.S. Chemical Company with Auto-Color Malware
On July 30, 2025, cybersecurity experts reported a significant breach involving a critical vulnerability in SAP NetWeaver, previously patched by SAP. In an incident that unfolded over three days in April 2025, threat actors targeted a U.S.-based chemicals company, leveraging the flaw to infiltrate the organization’s network and deploy the Auto-Color backdoor.
The vulnerability at the center of this breach, identified as CVE-2025-31324, is a severe unauthenticated file upload issue that facilitates remote code execution (RCE). This critical flaw was promptly addressed by SAP in April, yet its exploitation highlights the urgency for organizations to implement timely updates and stringent security measures.
According to a report from Darktrace, the hackers not only gained initial access to the chemicals company’s network but also attempted to download multiple suspicious files. Their activities were linked to infrastructure associated with the Auto-Color malware, suggesting sophisticated efforts to maintain persistent access within the compromised network.
Auto-Color, which was first documented by Palo Alto Networks Unit 42 in February 2025, operates similarly to a remote access trojan, granting attackers extensive remote control over compromised Linux systems. Prior to this incident, the malware had already been observed in attacks against various educational and governmental organizations across North America and Asia during late 2024.
The tactics and techniques employed during this attack appear to align with several categories within the MITRE ATT&CK framework. Initial access may have been achieved through exploiting the SAP vulnerability, while the ongoing presence of the Auto-Color backdoor indicates a strategy for persistence within the victim’s network. Furthermore, techniques for privilege escalation could have been utilized to expand the attackers’ control and access rights, enhancing their operational capabilities.
As the cybersecurity landscape continues to evolve, this breach serves as a crucial reminder for businesses, particularly those in sectors handling critical materials, to prioritize vulnerability management and incident response preparedness. The exploitation of known vulnerabilities underlines the necessity of vigilance against emerging threats and the importance of prompt remediation efforts in safeguarding sensitive information.
Organizations should remain alert to similar vulnerabilities and ensure that their systems are routinely updated. Failure to address known issues can lead to significant risks, including unauthorized access and data exfiltration, potentially resulting in severe operational and reputational damage.
