Reddit NetSec

CVE Database V5

AlienVault OTX General

Exploit-DB RSS Feed

Reddit InfoSec News

CIRCL OSINT Feed

ThreatFox MISP Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A report from EclecticIQ on a China-Nexus nation-state cyber-espionage campaign against SAP NetWeaver reveals details of Chinese-speaking attackers' operations and how they target high-value networks.

The threat involves a cyber-espionage campaign attributed to China-Nexus nation-state actors exploiting a vulnerability identified as CVE-2023-46747 (also referenced as CVE-2025-31324) in SAP NetWeaver, a widely used enterprise application platform. SAP NetWeaver is critical infrastructure software that supports business processes and data management for many large organizations globally, including in Europe. The attackers leverage this vulnerability to deploy webshells such as 'vshell' and 'snowlight', enabling persistent remote access and control over compromised systems. The campaign is characterized by the use of advanced malware loaders like 'krustyloader' and command and control frameworks such as 'sliver'. Techniques observed include network reconnaissance (T1016), spear-phishing (T1566), credential dumping (T1140), process injection or masquerading (T1036), and command execution (T1059), indicating a sophisticated multi-stage attack chain aimed at infiltrating and maintaining access within high-value networks. The attackers specifically target critical infrastructure sectors, which are vital for national security and economic stability. Although no known exploits are currently observed in the wild, the presence of detailed technical indicators and the involvement of a nation-state adversary suggest a high likelihood of exploitation attempts. The campaign also involves attempts to compromise Azure Active Directory environments, indicating a focus on cloud-integrated enterprise environments. The lack of affected version details and patch information suggests that organizations may be unaware or unprepared for this threat, increasing the risk of successful exploitation.

CC=SG ASN=AS47583 hostinger international limited

MD5 of 3f14dc65cc9e35989857dc1ec4bb1179ab05457f2238e917b698edb4c57ae7ce

MD5 of b9533ce8e428f16f3d0e1946f19a6f756ff11a532d0b7e61ae402837f46c678e

MD5 of 47ff0ae9220a09bfad2a2fb1e2fa2c8ffe5e9cb0466646e2a940ac2e0cf55d04

MD5 of 888e953538ff668104f838120bc4d801c41adb07027db16281402a62f6ec29ef

SHA1 of b9533ce8e428f16f3d0e1946f19a6f756ff11a532d0b7e61ae402837f46c678e

SHA1 of 47ff0ae9220a09bfad2a2fb1e2fa2c8ffe5e9cb0466646e2a940ac2e0cf55d04

SHA1 of 3f14dc65cc9e35989857dc1ec4bb1179ab05457f2238e917b698edb4c57ae7ce

SHA1 of 888e953538ff668104f838120bc4d801c41adb07027db16281402a62f6ec29ef

CC=HK ASN=AS58985 sunday network (hong kong) ltd

CC=KR ASN=AS20473 the constant company  llc

CC=US ASN=AS21769 colocation america corporation

CC=US ASN=AS139640 hk new cloud technology limited

CC=US ASN=AS47869 ellada projects b.v. trading as netrouting

CC=US ASN=AS749 dod network information center

CC=US ASN=AS20473 the constant company  llc

CC=CN ASN=AS45090 shenzhen tencent computer systems company limited

CC=CA ASN=AS20473 the constant company  llc

Detailed information about China-Nexus Nation State Actors Exploit SAP NetWeaver (CVE-2025-31324) to Target Critical Infrastructures. Get real-time updates, tec

China-Nexus Nation State Actors Exploit SAP NetWeaver (CVE-2025-31324) to Target Critical Infrastructures - Live Threat Intelligence - Threat Radar | OffSeq.com

Title	Severity	Type	Source	Date

Threats Tagged 'sap netweaver'

Filter Threats

Threats Tagged 'sap netweaver'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility