SAP NetWeaver Flaw Draws Hackers

Every week, Information Security Media Group rounds up cybersecurity incidents and breaches around the world. This week, SAP NetWeaver flaw drew hackers, chained zero-days in Ivanti Endpoint Mobile Manager, DOGE employee’s credentials found in infostealer dumps and Nucor halted operations. North Korean hackers targeted South Koreans with fake conference invites, Russian hackers targeted webmail servers and Microsoft released 72 patches.

See Also: Top 10 Technical Predictions for 2025

Ransomware gangs RansomEXX and BianLian joined ongoing attacks on SAP NetWeaver servers, targeting a critical vulnerability tracked CVE-2025-31324 that enables unauthenticated remote code execution. SAP issued emergency patches on April 24 after cybersecurity firm ReliaQuest flagged in-the-wild exploitation of the flaw.

The vulnerability enables attackers to upload malicious files without credentials, potentially leading to full system compromise. ReliaQuest said RansomEXX actors used their PipeMagic backdoor and the Windows CLFS flaw in one incident.

Chinese nation-state groups are also exploiting the bug. Forescout linked attacks to group Chaya_004, identifying 581 back doored NetWeaver systems and plans to target 1,800 more.

The U.S. Cybersecurity and Infrastructure Security Agency added CVE-2025-31324 to its Known Exploited Vulnerabilities Catalog, requiring U.S. federal agencies to patch by May 20.

Beleaguered edge device maker Ivanti warned customers Monday that hackers are using two zero-day flaws in its Endpoint Manager Mobile platform to gain unauthenticated access followed by remote code execution.

The Utah company said it released updates after becoming aware of “a very limited number of customers whose solution has been exploited at the time of disclosure.” The flaws are tracked as CVE-2025-4427 and CVE-2025-4428.

Ivanti has been on a two-year journey of discovering how hackable its products are (see: Ivanti Uses End-of-Life Operating Systems, Software Packages).

In this case, Ivanti said the flaw ultimately didn’t originate with it, but with unnamed third party open-source libraries. The company is “engaging with the maintainers,” it said.

In a blog post, cybersecurity company Watchtowr predicted that Ivanti’s description of “a very limited number” of affected customers likely won’t stay that way. “What we know though for sure is – once ‘highly targeted’ operations get publicized, we’ve seen attackers just mass pwn everything on the internet to obtain any remaining value,” it wrote.

A Tenable researcher wrote that CVE-2025-4427 allows remote attackers to gain access to the EPMM application programming interface, something normally only accessible to authentication users. CVE-2025-4428 is a remote code execution flaw. “An attacker that successfully exploits these flaws could chain them together to execute arbitrary code on a vulnerable device without authentication.”

Activist coder Micah Lee spotted last Thursday data breach records and four infostealer log dumps associated with the personal Gmail of Department of Government Efficiency employee Kyle Schutt on breach tracking service Have I Been Pwned.

Schutt, a software engineer, has popped up at various federal agencies since Elon Musk-led DOGE began earlier this year a campaign of cost-cutting and code-rewriting of uncertain legality within the U.S. government. He has reportedly gained access to the core financial management system and the Federal Emergency Management Agency and joined the Cybersecurity and Infrastructure Security Agency.

Lee said Schutt’s credentials appeared in massive data dumps such as Naz.API, Alien txtbase and Telegram-leaked logs. Lee said it’s unclear when or how often Schutt was hacked but urged DOGE staff to avoid using personal devices for government work.

North America’s largest steelmaker Nucor temporarily shut down operations at select sites following a cybersecurity incident involving unauthorized access to its IT systems. The North Carolina company said it activated its incident response plan, took affected systems offline and is working on recovery. It did not disclose which of its roughly 300 facilities were impacted.

North Korean hacking group APT37, also known as ScarCruft, Reaper and InkySquid, used spear-phishing emails in March to target South Korean individuals with malware-laced attachments disguised as national security conference invites and troop movement intelligence.

Researchers at South Korea’s Genians uncovered that APT37 delivered malicious LNK files via Dropbox, deploying the RoKRAT malware on victims’ devices. One campaign impersonated a regional expert and claimed to offer intel on North Korean troop deployments in Russia. Another mimicked a real event titled “Trump 2.0 Era: Prospects and South Korea’s Response.” In both, APT37 used theme-relevant images and Dropbox-hosted payloads to trick victims.

RoKRAT, once deployed, steals system data, captures screenshots, executes commands and gathers files. The LNK files ran hidden PowerShell scripts while showing a decoy document to distract victims. Genians linked the malware to earlier campaigns using K Messenger chatrooms and noted continued abuse of cloud services like Dropbox, Yandex, Google Drive and OneDrive for command-and-control.

A Russian cyberespionage operation is attacking webmail server clients used by Ukrainian government agencies and defense companies in Bulgaria and Romania that produce Soviet-era weapons used by the Ukrainian military.

Security researchers from Eset say they’ve observed a pattern of webserver hacking since 2023 by the Russian Main Intelligence Directorate, a unit known variously as APT28, Fancy Bear or Forest Blizzard. Eset tracks it as Sednit.

In a campaign Eset dubs Operation RoundPress, Russian state hackers used cross-site scripting vulnerabilities in webmail servers, at first concentrating on Roundcube software but branching out in 2024 to target Horde, MDaemon and Zimbra. Sednit likely discovered a zero-day vulnerability in MDaemon, tracked as CVE-2024-11182 but used known flaws to attack to the other webmail servers, Eset wrote.

To compromise the victims, the hackers spread XSS exploits in spear phishing emails, which downloaded malicious JavaScript code containing variants of “Spyrpress” malware that tricks browsers and password manager to fill webmail credentials into a hidden form. Some samples tricked users by logging them out of their webmail and displaying a fake login page.

The Ukrainian Computer Emergency Response Team in 2023 warned about a Russian campaign that exploited three RoundCube flaws. Eset said other Operation RoundPress targets have included government agencies in Africa, the European Union and South America.

Webmail servers continue to be a target for hackers because many organizations fail to keep their systems up to date. “Because the vulnerabilities can be triggered remotely by sending an email message, it is very convenient for attackers to target such servers for email theft,” Eset researchers added.

Microsoft’s May Patch Tuesday addressed security fixes for 72 vulnerabilities, among them five zero-days that have already been exploited and two that were publicly disclosed. Six of the patched flaws are rated critical, most involving remote code execution, with the rest spanning privilege escalation, denial of service, spoofing and information disclosure issues.

Among the actively exploited vulnerabilities is a serious flaw in the Windows DWM Core Library, enabling attackers to elevate privileges to system through a use-after-free bug. Similar privilege escalation flaws in the Windows Common Log File System Driver and the Ancillary Function Driver for WinSock were found and fixed. A fifth exploited bug, affecting the Microsoft Scripting Engine, enables remote code execution if a user is tricked into clicking a crafted link in Edge or Internet Explorer.

Microsoft also addressed a publicly disclosed spoofing vulnerability in Microsoft Defender for Identity, which enables an attacker on the same network to impersonate accounts. Another publicly disclosed flaw in Visual Studio could enable command injection and local code execution.

Other Stories From Last Week

With reporting from Information Security Media Group’s Jayant Chakravarti in India, Akshaya Asokan in Southern England and David Perera in Northern Virginia.