China-Linked APTs Target 581 Critical Systems Worldwide Using SAP Vulnerability CVE-2025-31324
May 13, 2025
Vulnerability / Threat Intelligence
A newly identified critical security vulnerability in SAP NetWeaver is being exploited by several nation-state actors linked to China to infiltrate vital infrastructure networks. “Threat actors are taking advantage of CVE-2025-31324, an unauthenticated file upload vulnerability that allows for remote code execution (RCE),” stated EclecticIQ researcher Arda Büyükkaya in a recent analysis. Targets include natural gas distribution, water and waste management utilities in the UK, medical device manufacturing facilities, oil and gas companies in the U.S., and investment and financial regulation ministries in Saudi Arabia. This assessment is based on a publicly accessible directory found on compromised attacker-controlled infrastructure (15.204.56[.]106), which contained event logs detailing activities across numerous breached systems.
Vulnerability / Threat Intelligence
China-Affiliated APTs Target 581 Critical Systems via SAP CVE-2025-31324 Exploit May 13, 2025 Vulnerability / Threat Intelligence A newly revealed severe security vulnerability in SAP NetWeaver is being actively exploited by various state-sponsored actors with links to China, posing significant risks to critical infrastructure networks globally. Researchers, including EclecticIQ’s Arda…
China-Linked APTs Target 581 Critical Systems Worldwide Using SAP Vulnerability CVE-2025-31324
May 13, 2025
Vulnerability / Threat Intelligence
A newly identified critical security vulnerability in SAP NetWeaver is being exploited by several nation-state actors linked to China to infiltrate vital infrastructure networks. “Threat actors are taking advantage of CVE-2025-31324, an unauthenticated file upload vulnerability that allows for remote code execution (RCE),” stated EclecticIQ researcher Arda Büyükkaya in a recent analysis. Targets include natural gas distribution, water and waste management utilities in the UK, medical device manufacturing facilities, oil and gas companies in the U.S., and investment and financial regulation ministries in Saudi Arabia. This assessment is based on a publicly accessible directory found on compromised attacker-controlled infrastructure (15.204.56[.]106), which contained event logs detailing activities across numerous breached systems.
