SAP Flaw Exploited by Ransomware Groups and Chinese
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-31324 | Unauthenticated File Upload RCE in SAP NetWeaver Visual Composer | 9.8 | 99% | KEVRansomwarePoC | KEV |
| CVE-2025-42999 | Insecure Deserialization in SAP NetWeaver Visual Composer Metadata Uploader | 9.1 | 13% | KEVRansomwarePoC | KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | aaaaabbbbbbb.eastus.cloudapp.azure.com | methodology, with sandbox analysis confirming beaconing to aaaaabbbbbbb[.]eastus[.]cloudapp[.]azure[.]com, a domain tied to both PipeMagic and RansomEXX,” sa |
| ipv4 | 184.174.96.70 | rs64.exe executable. This server is related to another IP, 184[.]174[.]96[.]70, operated by the same hosting provider. The second IP |
| ipv4 | 184.174.96.74 | -31324 exploitation was evident. “We identified a server at 184[.]174[.]96[.]74 hosting reverse proxy services initiated by the rs64. |
From the original article
3 min read at infosecurity-magazine.com
Cybersecurity researchers are piling up evidence that a critical vulnerability affecting German software company SAP’s NetWeaver Visual Composer development server is being exploited in the wild by a range of threat actors. These include ransomware groups BianLian and RansomwEXX, as well as at least one Chinese nation-state actor known as Chaya_004.
By Kevin Poireault · infosecurity-magazine.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.