Chinese hackers behind attacks targeting SAP NetWeaver servers

Forescout and other security firms observed active exploitation of a critical SAP NetWeaver Visual Composer zero-day (CVE-2025-31324) that permits unauthenticated file uploads; attackers have been uploading JSP web shells and post-exploitation tools, compromising hundreds of exposed instances. The activity—dated from at least January–March 2025—has been linked to a Chinese threat actor tracked as Chaya_004, prompting emergency patches and CISA inclusion of the CVE in its Known Exploited Vulnerabilities Catalog.