Chinese Hackers Exploit SAP NetWeaver Zero-Day (CVE-2025-31324)

A critical cybersecurity threat is unfolding as a Chinese hacker group exploits an unpatched vulnerability in SAP NetWeaver. This zero-day flaw, tracked as CVE-2025-31324, enables attackers to execute remote code without authentication, jeopardizing enterprise systems across the globe. If you manage SAP environments, this issue demands your immediate attention. In this blog, we unpack how these attacks occur, highlight evidence linking them to the threat actor Chaya_004, and provide clear guidance on patching and detecting compromise.

How Are Chinese Hackers Exploiting SAP NetWeaver?

Cybersecurity experts have observed sophisticated attack vectors targeting SAP NetWeaver vulnerabilities. Attackers leverage an unauthenticated file upload mechanism in SAP NetWeaver Visual Composer to introduce malicious files, such as JSP web shells, which can lead to full system takeover. Key points include:

• Exploitation of the SAP NetWeaver security flaw (CVE-2025-31324) allows remote code execution.
• Use of unauthorized file uploads, as detailed by reputable sources like BleepingComputer.
• Deployment of JSP web shells and tools such as Brute Ratel in post-exploitation phases.

Evidence Linking Attacks to Chinese Threat Actor Chaya_004

Recent investigations, including an analysis by Forescout’s Vedere Labs, have traced these attacks back to a Chinese threat actor, now identified as Chaya_004. Their tactics include:

• IP addresses using self-signed certificates that mimic trusted entities like Cloudflare.
• Hosting malicious infrastructure on Chinese cloud providers such as Alibaba and Huawei Cloud Service.
• Deployment of Chinese-language tools including a web-based reverse shell called SuperShell.

Multiple cybersecurity firms including Onapsis and reports from ReliaQuest further confirm these observations. Mandiant has also noted that exploitation attempts date back to mid-March 2025.

Is Your SAP NetWeaver Server Vulnerable? (Checklist)

If you manage SAP systems, consider the following mitigation checklist:

1. Apply the Emergency Patch: SAP released an out-of-band patch on April 24 to fix this flaw. Ensure your systems are updated immediately.
2. Audit File Uploads: Monitor for unauthorized file uploads, especially suspicious JSP files in public directories.
3. Restrict Metadata Uploads: Limit access to metadata uploader services whenever possible.
4. Monitor Network Traffic: Be alert for unusual activities that could indicate reconnaissance or exploitation attempts.
5. Consult Security Advisories: Follow resources like the CISA alert and the Known Exploited Vulnerabilities Catalog for updates.

Emergency Mitigation: Patch and Detect Compromise

The implications of leaving this vulnerability unaddressed are severe. With over a thousand vulnerable SAP NetWeaver instances documented by the Shadowserver Foundation, a comprehensive approach to mitigation is essential:

• Patch Immediately: Download and install the emergency patch from SAP to secure your system against the zero-day exploit.
• Deploy Intrusion Detection Systems: Utilize network monitoring and endpoint security to identify and quarantine suspicious activities.
• Engage Cybersecurity Experts: If you suspect a compromise, contact a dedicated team to assess and remediate the breach.
• Stay Educated: Regularly review updates from organizations such as CISA, Forescout, and Onapsis for new threat intelligence.

Conclusion & Call-to-Action

In the evolving landscape of cybersecurity, the exploitation of SAP NetWeaver through the CVE-2025-31324 flaw by Chinese hackers is a clear and present danger to enterprise systems worldwide. This zero-day vulnerability presents a direct pathway to remote code execution and complete system compromise. It is imperative for SAP administrators, enterprise security teams, and IT managers to act without delay. Patch your SAP NetWeaver installation now, monitor your systems for indicators of compromise, and consult the detailed threat reports from experts such as Forescout, Onapsis, and CISA.

For more information on patching vulnerabilities and advanced mitigation strategies, consider exploring further resources and attending industry webinars on cybersecurity best practices. Stay informed, stay secure, and protect your enterprise from these relentless cyber threats.

Key Resources: SAP Emergency Patch Release | CVE-2025-31324 Details | CISA Alert

Action Required: Patch your SAP NetWeaver systems immediately to safeguard against these advanced cyberattacks.