BianLian and RansomExx Exploit SAP NetWeaver Flaw to Deploy PipeMagic Trojan
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-29824 | Use-After-Free Privilege Escalation in Microsoft Windows CLFS Driver (Actively Exploited) CVE-2025-29824 is a use-after-free flaw (CWE-416) in the Windows Common Log File System (CLFS) kernel driver, scored 7.8 (High) with a local attack vector, low privileges required, and no user interaction. An authorized local attacker can trigger it by interacting with CLFS-managed log files in a way that references freed kernel memory. Successful exploitation elevates the attacker's local privileges, typically to SYSTEM, providing full control of the host that can be chained into ransomware deployment or lateral movement. Any unpatched system running the listed Windows 10, Windows 11, or Windows Server versions is affected. The flaw was exploited as a zero-day — reportedly by Play ransomware — before Microsoft shipped fixes in the April 2025 Patch Tuesday release; it was added to CISA's KEV catalog on 2025-04-08 with known ransomware use, and EPSS estimates a 13.9% probability of continued exploitation over 30 days (96th percentile). Do: Apply Microsoft's April 2025 Patch Tuesday security updates for your Windows version immediately — the vendor update is the only complete fix, and the flaw is on the KEV list with known ransomware use, so prioritize servers and endpoints used by privileged users. Until patched, limit untrusted local code execution and review hosts for post-exploitation privilege escalation; public detection and mitigation scripts (e.g., Vicarius) are available to help hunt for exploitation. Federal agencies must apply the vendor mitigations per BOD 22-01 deadlines or discontinue use of affected versions. | 7.8 | 14% | KEV ransomware PoC ×2 |
| massHundreds of millions of Windows devices worldwide | |
| CVE-2025-31324 | Unauthenticated File Upload RCE in SAP NetWeaver Visual Composer CVE-2025-31324 is a critical (CVSS 9.8) unrestricted file upload flaw (CWE-434) in the Visual Composer Metadata Uploader component of SAP NetWeaver, which lacks proper authorization. An unauthenticated attacker can send crafted upload requests over the network to the Metadata Uploader endpoint and plant malicious executable binaries, such as webshells, on the host. Executing the uploaded files yields remote code execution with full impact on confidentiality, integrity, and availability, enabling system compromise, lateral movement, and ransomware deployment. Any organization running the affected SAP NetWeaver component is at risk, with the greatest exposure for instances reachable from the internet. Exploitation is confirmed in the wild: the flaw was added to CISA KEV on 2025-04-29, a public PoC exists, and researchers and media report active attacks, including by Chinese-linked actors deploying Golang-based implants on Linux systems and known ransomware use, often chained with CVE-2025-42999. Do: Apply SAP's patch for CVE-2025-31324 (released in the April 2025 security updates) and follow the vendor mitigation instructions per CISA KEV/BOD 22-01 requirements. As interim mitigation, restrict or disable the Visual Composer Metadata Uploader endpoint and ensure it is not reachable from the internet; also patch the related CVE-2025-42999 since the flaws are being chained. Check affected hosts for uploaded webshells, Golang-based implants, and signs of ransomware activity. | 9.8 | 100% | KEV ransomware PoC |
| largetens of thousands of enterprise deployments worldwide, with several thousand instances directly internet-exposed | |
| CVE-2025-42999 | Insecure Deserialization in SAP NetWeaver Visual Composer Metadata Uploader CVE-2025-42999 is an insecure deserialization flaw (CWE-502) in the Visual Composer Metadata Uploader component of SAP NetWeaver. It is triggered when a privileged user uploads untrusted or malicious content to the Metadata Uploader, which the application then deserializes; on its own the flaw requires high-privilege access, but attackers commonly chain it with the separately tracked unauthenticated upload flaw CVE-2025-31324 in the same component. Successful exploitation can yield remote code execution and full compromise of the host's confidentiality, integrity, and availability, with impact beyond the vulnerable component (CVSS scope changed, 9.1 critical). Any organization running SAP NetWeaver with the Visual Composer Metadata Uploader enabled, especially internet-facing application servers, is affected. Exploitation is confirmed in the wild: CISA added it to the Known Exploited Vulnerabilities catalog on 2025-05-15 with known ransomware use, and reporting links active attacks to ransomware groups (BianLian and RansomExx deploying the PipeMagic trojan) and to Chinese-linked APTs exploiting the sibling CVE-2025-31324. Do: Apply SAP's security patches addressing CVE-2025-42999 together with the companion CVE-2025-31324 in the same Visual Composer Metadata Uploader, per vendor instructions, or restrict/disable access to the Metadata Uploader endpoint if patching is delayed. Given confirmed ransomware use (BianLian, RansomExx) and PipeMagic trojan deployments, review upload and authentication logs on NetWeaver servers and hunt for signs of compromise and post-exploitation activity. U.S. federal agencies must follow CISA BOD 22-01 guidance: apply mitigations by the KEV remediation due date or discontinue use of affected instances. | 9.1 | 14% | KEV ransomware PoC |
| moderatelow thousands of internet-exposed SAP NetWeaver servers (≈1k–10k systems), with a substantially larger internal install base |
Full article684 words · extracted from thehackernews.com · click to collapse
At least two different cybercrime groups BianLian and RansomExx are said to have exploited a recently disclosed security flaw in SAP NetWeaver tracked as CVE-2025-31324, indicating that multiple threat actors are taking advantage of the bug.
Cybersecurity firm ReliaQuest, in a new update published today, said it uncovered evidence suggesting involvement from the BianLian data extortion crew and the RansomExx ransomware family, which is traced by Microsoft under the moniker Storm-2460.
BianLian is assessed to be involved in at least one incident based on infrastructure links to IP addresses previously identified as attributed to the e-crime group.
"We identified a server at 184[.]174[.]96[.]74 hosting reverse proxy services initiated by the rs64.exe executable," the company said. "This server is related to another IP, 184[.]174[.]96[.]70, operated by the same hosting provider. The second IP had previously been flagged as a command-and-control (C2) server associated with BianLian, sharing identical certificates and ports."
ReliaQuest said it also observed the deployment of a plugin-based trojan dubbed PipeMagic, which was most recently used in connection with the zero-day exploitation of a privilege escalation bug (CVE-2025-29824) in the Windows Common Log File System (CLFS) in limited attacks targeting entities in the U.S., Venezuela, Spain, and Saudi Arabia.
The attacks involved the delivery of PipeMagic by means of web shells dropped following the exploitation of the SAP NetWeaver flaw.
"Although the initial attempt failed, a subsequent attack involved the deployment of the Brute Ratel C2 framework using inline MSBuild task execution," ReliaQuest said. "During this activity, a dllhost.exe process was spawned, signaling exploitation of the CLFS vulnerability (CVE-2025-29824), which the group had previously exploited, with this being a new attempt to exploit it via inline assembly."
The findings come a day after EclecticIQ disclosed that multiple Chinese hacking groups tracked as UNC5221, UNC5174, and CL-STA-0048 are actively exploiting CVE-2025-31324 to drop various malicious payloads.
SAP security company Onapsis revealed that threat actors have also been exploiting CVE-2025-31324 alongside a deserialization flaw in the same component (CVE-2025-42999) since March 2025, adding the new patch fixes the root cause of CVE-2025-31324.
"There is little practical difference between CVE-2025-31324 and CVE-2025-42999 as long as CVE-2025-31324 is available for exploitation," ReliaQuest said in a statement shared with The Hacker News.
"CVE-2025-42999 indicates higher privileges would be required, however, CVE-2025-31324 affords full system access regardless. A threat actor could exploit both vulnerabilities in an authenticated and unauthenticated user in the same way. Therefore, the remediation advice is the same for both CVEs."
Update
In a new analysis, OP Innovate has disclosed that it identified evidence of CVE-2025-31324 (and by extension CVE-2025-42999) being exploited by threat actors tied to the Qilin ransomware operation at least three weeks before details of the bug became public knowledge.
"Weeks before CVE-2025-31324 appeared in public advisories, an attacker exploited the vulnerable Metadata Uploader endpoint within SAP NetWeaver," the Israeli company said. "The attacker uploaded several JSP-based webshells to the SAP IRJ directory."
The attacker is said to have then initiated outbound communication with Cobalt Strike command-and-control (C2) infrastructure, downloaded a reverse SOCKS5 tunneling tool ("rs64c.exe") from the IP address 184[.]174[.]96[.]74. Interestingly, the same indicators of compromise have been attributed by ReliaQuest to the BianLian data extortion group.
"The attacker's use of IP address 184[.]174[.]96[.]74 and the tool rs64c.exe closely matches infrastructure and tools previously associated with Qilin, a Russian-speaking ransomware-as-a-service (RaaS) group," Matan Matalon, CISO and Head of IR at OP Innovate, said.
"In both incidents, the attacker successfully gained initial access and remote code execution by exploiting CVE-2025-31324. However, post-exploitation efforts failed completely in both cases."
The findings reflect the growing interest in weaponizing high-profile vulnerabilities for financial gain, not to mention a widening of cyber intrusions exploiting the SAP NetWeaver flaw.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA), on Thursday, added CVE-2025-42999 to its Known Exploited Vulnerabilities (KEV) catalog, requiring federal agencies to apply the fixes by June 5, 2025.
(The story was updated after publication to include additional details of the exploitation activity.)
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2025/05/bianlian-and-ransomexx-exploit-sap.html