From Automated Scans to Hands On Keyboard: China Nexus APTs Exploited SAP NetWeaver to Breach Critic
summary
April–May 2025 intrusions exploit an SAP NetWeaver metadata uploader to install web shells and pivot into energy and water networks, with an attacker-controlled open directory revealing TXT victim lists and bash history; analysts recover the full kill chain from nuclei scans → webshell upload to post‑exploit tooling, find 500+ NetWeaver instances backdoored, observe payloads like SnowLight and SLT, and persistent access via go-reverse SSH reverse shells and SuperShell C2, enabling disruption through CERT notifications.
AI-written summary · about
chapters (7)
- 0:00China Nexus APTs overview
- 0:44SAP NetWeaver exploitation
- 2:11Post-exploitation techniques
- 4:37Malware and tools used
- 6:44C2 infrastructure analysis
- 8:52APT group attribution
- 10:16Closing remarks
related talks
36mChained to Hit: Discovering New Vectors to Gain Remote and Root Access in SAP Enterprise Software
52mDevSecOps
58mAttacking through the Software Supply Chain
46mHow to hack a node app?
55mRevealing the Attack Operations Targeting Japan
50mStranger Danger: Your Java Attack Surface Just Got Bigger
50mInsights into New Supply Chain and Cloud-Identity Attacks
32mOperation Clairvoyance: How APT Groups Spy on the Media Industry