Darktrace Details SAP NetWeaver Exploitation Detected Before CVE-2025-31324 Disclosure
Summary
Darktrace describes two cases of suspected SAP NetWeaver exploitation, including activity detected six days before CVE-2025-31324 was disclosed, KrustyLoader downloads, and a later attempt blocked by its response system.
Key points
- CVE-2025-31324 is an unauthenticated arbitrary-file-upload flaw in SAP NetWeaver Visual Composer that can enable remote code execution; SAP issued a patch on May 13, 2025.
- Darktrace detected OAST-domain lookups on an internet-facing system believed to be SAP six days before the vulnerability's public disclosure.
- The same system later downloaded executable files linked to KrustyLoader, which can deploy the Sliver command-and-control tool.
- In a separate case, a manufacturing customer's SAP device made OAST lookups and attempted to download a privilege-escalation tool from 23.95.123[.]5.
- Darktrace alerted its SOC, notified the customer, and used Autonomous Response to block connections to the suspicious IP.
- The article says multiple threat actors have targeted the flaw, including groups associated with China and ransomware groups.
Article Details
- Attack Vectors
- CVE-2025-31324 exploitation through crafted GET, POST, or HEAD requests to the SAP NetWeaver Visual Composer /developmentserver/metadatauploader endpoint, enabling unauthenticated arbitrary file upload and potentially remote code execution.
- Uploading executable files, including web shells, to internet-facing SAP NetWeaver systems.
- Observed DNS requests to OAST domains for exploit testing or validation.
- Downloading executable files from Amazon S3-hosted URLs; one observed download attempt used port 666.
- Defensive Notes
- SAP released a workaround on April 8, 2025, and a patch on May 13, 2025, in Security Note 3604119.
- Darktrace recommends investigating suspicious OAST DNS requests, unusual executable downloads, rare HTTP destination ports, and new user agents on internet-facing systems.
- Darktrace reports that its Autonomous Response blocked connections to 23.95.123[.]5 during the observed incident.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | aaaaaaaa[.]d06qqn7pu5a6u25tv9q08p5xhbjzw33ge[.]oast[.]online | OAST domain queried by an SAP device during activity the article says suggested exploit validation. |
| DOMAIN | aaaaaaaaaaa[.]d07j2htekalm3139uk2gowmxuhapkijtp[.]oast[.]pro | OAST domain queried by an SAP device during activity the article says suggested exploit validation. |
| DOMAIN | cvvr9gl9namk9u955tsgaxy3upyezhnm6[.]oast[.]online | OAST domain queried by the system believed to be SAP; the article links the observed activity to suspected exploitation. |
| MD5 | 29274ca90e6dcf5ae4762739fcbadf01 | File hash identified as JuicyPotato/SweetPotato in the IOC list; also listed there as a KrustyLoader hash. |
| MD5 | 6900e844f887321f22dd606a6f2925ef | File hash listed as a high-confidence KrustyLoader indicator. |
| MD5 | 72afde58a1bed7697c0aa7fa8b4e3b03 | File hash listed as a high-confidence indicator. |
| MD5 | 83a797e5b47ce6e89440c47f6e33fa08 | File hash listed as a high-confidence indicator. |
| MD5 | 8c8681e805e0ae7a7d1a609efc000c84 | File hash listed as a high-confidence KrustyLoader indicator. |
| MD5 | f662135bdd8bf792a941ea222e8a1330 | File hash listed as a high-confidence KrustyLoader indicator. |
| SHA1 | 17d65a9d8d40375b5b939b60f21eb06eb17054fc | File hash listed as a high-confidence KrustyLoader indicator. |
| SHA1 | a29e8f030db8990c432020441c91e4b74d4a4e16 | File hash listed as a high-confidence indicator. |
| SHA1 | da23dab4851df3ef7f6e5952a2fc9a6a57ab6983 | File hash listed as a high-confidence KrustyLoader indicator. |
| SHA1 | e007edd4688c5f94a714fee036590a11684d6a3a | Hash of the suspicious executable identified as JuicyPotato or SweetPotato. |
| SHA1 | fa645f33c0e3a98436a0161b19342f78683dbd9d | File hash listed as a high-confidence KrustyLoader indicator. |
| SHA1 | fe931adc0531fd1cb600af0c01f307da3314c5c9 | File hash listed as a high-confidence indicator. |
| SHA256 | 1544d9392eedf7ae4205dd45ad54ec67e5ce831d2c61875806ce4c86412a4344 | File hash listed as a high-confidence KrustyLoader indicator. |
| SHA256 | 1d26fff4232bc64f9ab3c2b09281d932dd6afb84a24f32d772d3f7bc23d99c60 | File hash listed as a high-confidence KrustyLoader indicator. |
| SHA256 | 3268f269371a81dbdce8c4eedffd8817c1ec2eadec9ba4ab043cb779c2f8a5d2 | File hash identified as JuicyPotato/SweetPotato in the IOC list. |
| SHA256 | b8e56de3792dbd0f4239b54cfaad7ece3bd42affa4fbbdd7668492de548b5df8 | File hash listed as a high-confidence KrustyLoader indicator. |
| URL | hxxp[:]//23[.]95[.]123[.]5:666/xmrigCCall/s.exe | Suspicious executable download URL identified by Darktrace; associated in the article with JuicyPotato or SweetPotato. |
MITRE ATT&CK
T1105 · Ingress Tool TransferKrustyLoader downloaded executable files and is described as downloading and launching a second-stage payload.T1190 · Exploit Public-Facing ApplicationThreat actors exploited the internet-facing SAP NetWeaver Visual Composer vulnerability to upload files and potentially obtain remote code execution.
CVE
People
Threat Actors
ARMORY CASTLEReportedly targeted CVE-2025-31324 and is associated with KrustyLoader; the article says it is also known as UTA0178.BianLianNamed as a ransomware group reportedly targeting the vulnerability.Chaya_004Reportedly targeted CVE-2025-31324.CL-STA-0048Reportedly targeted CVE-2025-31324.GelsemiumThe file hash and external endpoint were previously associated with this group, according to the article; it notes that multiple actors use the tools involved.QilinNamed as a ransomware group reportedly targeting the vulnerability.RansomEXXNamed as a ransomware group reportedly targeting the vulnerability; the article says it is also known as Storm-2460.UNC5174Reportedly targeted CVE-2025-31324.UTA0178Identified in the article as another name for UNC5221.
Malware
Vendors
Products
Darktrace / NETWORKFigure 3: Darktrace / NETWORK’s detection of an SAP device performing a large volume of suspicious activity between April 27 and April 29.The device was observed making DNS requests for OAST domains (e.g.SAP NetWeaverGlobal enterprises depend extensively on SAP platforms, such as SAP NetWeaver and Visual Composer, to run critical business processes worldwide. These systems; however, are increasingly appealing targets forVisual ComposerGlobal enterprises depend extensively on SAP platforms, such as SAP NetWeaver and Visual Composer, to run critical business processes worldwide. These systems; however, are increasingly appealing targets for
Tools
Cobalt Strikemalware which downloads and launches a second-stage payload – Sliver C2. Sliver is a similar tool to Cobalt Strike (an open-source post-exploitation toolkit). It is used for command-and-control (C2) connectionsJuicyPotatoMultiple open-source intelligence (OSINT) vendors have identified the executable file as either JuicyPotato or SweetPotato, both Windows privilege escalation tools[16][17][18][19]. The file hash and the unusual externalSliver[10] [14] [15]. It is an initial-stage malware which downloads and launches a second-stage payload – Sliver C2. Sliver is a similar tool to Cobalt Strike (an open-source post-exploitation toolkit). It is used forSweetPotatoopen-source intelligence (OSINT) vendors have identified the executable file as either JuicyPotato or SweetPotato, both Windows privilege escalation tools[16][17][18][19]. The file hash and the unusual external
Countries
Industries
logisticsdisclosure of CVE-2025-31324, Darktrace began to detect unusual activity on a device belonging to a logistics organization in the Europe, the Middle East and Africa (EMEA) region. Multiple IoCs observed during thisManufacturingBetween April 27 and 29, Darktrace observed unusual activity from an SAP device on the network of a manufacturing customer in EMEA.