China-Affiliated APTs Target 581 Critical Systems via SAP CVE-2025-31324 Exploit
May 13, 2025
Vulnerability / Threat Intelligence
A newly revealed severe security vulnerability in SAP NetWeaver is being actively exploited by various state-sponsored actors with links to China, posing significant risks to critical infrastructure networks globally. Researchers, including EclecticIQ’s Arda Büyükkaya, have identified the exploitation of CVE-2025-31324, a vulnerability that allows unauthenticated file uploads, thereby enabling remote code execution (RCE) on compromised systems.
The targets of this sophisticated campaign encompass a range of essential sectors, including natural gas distribution systems, water utilities, and waste management services in the United Kingdom. In the United States, medical device manufacturing plants and oil and gas firms are under threat, while Saudi Arabian government ministries responsible for investment strategy and financial regulations are also on the list. This extensive targeting highlights the vulnerability’s potential to disrupt not only individual companies but also entire sectors critical to national security and public welfare.
The intelligence regarding these attacks originates from a publicly accessible directory on an infrastructure controlled by the attackers, specifically linked to the IP address “15.204.56[.]106.” This repository contained event logs detailing the activities conducted across numerous compromised systems, offering a rare glimpse into the operational tactics employed by these adversaries.
Analysis of the attack suggests that multiple tactics and techniques from the MITRE ATT&CK framework were likely employed by the actors. Initial access could have been achieved through phishing or exploitation of the SAP vulnerability itself. Following this, perpetrators may have established persistence on affected systems to maintain control, while leveraging privilege escalation techniques to gain elevated access necessary for further action.
The ongoing exploitation of this vulnerability underscores the critical need for organizations utilizing SAP NetWeaver to bolster their cybersecurity measures. As nation-state threats continue to evolve, the imperative for robust risk management strategies becomes increasingly urgent.
Business owners must remain vigilant and informed about the potential risks associated with such vulnerabilities. Implementing comprehensive monitoring solutions and regular security assessments can mitigate risks associated with critical infrastructure attacks, ensuring operational integrity and stakeholder confidence amidst a challenging cyber landscape.
As this situation develops, further updates will emerge, and organizations are advised to stay updated on the latest cybersecurity protocols to safeguard against similar threats in the future.
