China’s Cyber Comedy: CVE-2025-31324 Takes Center Stage!
Attackers are exploiting CVE-2025-31324 with web shell backdoors. Forescout’s research suggests a Chinese nation-state actor, Chaya_004, is involved, using servers with Supershell backdoors. IPs impersonating Cloudflare, traced to Chinese providers, fuel suspicions. CISA’s KEV catalog now includes CVE-2025-31324, as SAP NetWeaver systems remain at risk.
Hot Take:
When life gives you lemons, some people make lemonade. When the cyber world gives you vulnerabilities, Chinese threat actors make backdoor lemonade! Who knew that SAP systems could be so juicy?
Key Points:
- Security firms Onapsis and WatchTowr have confirmed active exploitation of the CVE-2025-31324 vulnerability.
- Onapsis, in collaboration with Google Cloud’s Mandiant, released an open-source detection tool for affected SAP systems.
- The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2025-31324 to its Known Exploited Vulnerabilities catalog.
- Forescout’s Federe Labs reports potential involvement of Chinese nation-state actors exploiting the vulnerability.
- EclectiIQ has linked some SAP NetWeaver intrusions to Chinese cyber-espionage units.
Already a member? Log in here