China-Linked Hackers Exploit Vulnerabilities in SAP and SQL Server Across Asia and Brazil
May 30, 2025
In a concerning development for global cybersecurity, a China-linked threat actor has been identified as the driving force behind a significant exploitation of a critical vulnerability in SAP NetWeaver. This incident is part of a wider campaign targeting organizations across Brazil, India, and Southeast Asia since 2023. According to an analysis this week by Trend Micro security researcher Joseph C. Chen, the cybercriminals are particularly adept at exploiting SQL injection vulnerabilities found in web applications, which allows them to penetrate the SQL servers of their chosen targets.
The adversarial group’s activities are not limited to Brazil; they have also been reported to focus on nations such as Indonesia, Malaysia, the Philippines, Thailand, and Vietnam, indicating a comprehensive approach to their attacks. Trend Micro is monitoring these operations under the alias Earth Lamia, noting that their tactics show notable overlap with threat clusters recognized by various cybersecurity organizations. These include Elastic Security Labs’ REF0657, Sophos’ STAC6451, and Palo Alto Networks’ Unit 42.
The exploitation of web applications via SQL injection techniques allows attackers to leverage existing vulnerabilities in public-facing servers. This approach not only gains them access to sensitive data but also lays the groundwork for further malicious activities. The attackers’ methods may involve initial access techniques, including the use of phishing or stolen credentials, followed by persistence strategies to ensure ongoing access to compromised systems.
In line with the MITRE ATT&CK Matrix, the tactics employed in this campaign suggest a sequence of well-planned maneuvers. Following the initial compromise, the threat actor could escalate privileges to gain higher-level access within the network. This capability enables them to navigate through various systems undetected, further compounding the risk to targeted organizations. Additionally, they might employ lateral movement techniques to spread within an organization’s infrastructure, maximizing the impact of their attack.
Given the significance of these developments, business owners, especially those overseeing IT and cybersecurity strategies, must remain vigilant. Understanding the tactics and techniques highlighted in the MITRE framework serves as a vital tool in defensive planning. Organizations should prioritize patch management and the implementation of robust security protocols to mitigate the risk posed by such sophisticated adversaries.
As cyber threats evolve, the imperative for businesses to stay informed and responsive cannot be overstated. With the increasing complexity of attacks like those orchestrated by Earth Lamia, adopting a proactive cybersecurity posture is essential for safeguarding sensitive data and maintaining operational integrity.
