From Automated Scans to Hands On Keyboard: China Nexus APTs Exploited SAP NetWeaver

From Automated Scans to Hands On Keyboard: China Nexus APTs Exploited SAP NetWeaver

Speakers: Arda Büyükkaya, Senior Cyber Threat Intelligence Analyst, EclecticIQ

Conference: CYBERWARCON

YouTube: https://www.youtube.com/watch?v=pA1GrFwmD8E

Overview

In a compelling presentation at CYBERWARCON, Arda Büyükkaya, a Senior Cyber Threat Intelligence Analyst at EclecticIQ, shed light on a sophisticated campaign orchestrated by China Nexus Advanced Persistent Threat (APT) groups. The talk, titled "From Automated Scans to Hands On Keyboard: China Nexus APTs Exploited SAP NetWeaver," detailed a multi-stage attack chain that leveraged a vulnerability in SAP NetWeaver to gain initial access, establish persistence, and move laterally within critical infrastructure networks. Büyükkaya's analysis highlighted the adversaries' shift from initial automated scanning to highly targeted, hands-on keyboard operations, demonstrating a persistent and strategic approach to cyber espionage.

The core of the attack involved exploiting an API within the SAP NetWeaver metadata uploader to deploy a webshell, granting remote code execution capabilities. What began with the discovery of an open directory infrastructure containing victim lists evolved into a deep dive into the tactics, techniques, and procedures (TTPs) of these state-sponsored actors. The findings revealed a widespread compromise, with over 500 SAP NetWeaver instances backdoored, including those belonging to critical entities like water utilities, underscoring the severe implications for national security and essential services.

This article provides a comprehensive breakdown of Büyükkaya’s research, outlining the technical specifics of the exploitation, the sophisticated malware deployed, the attribution confidence to China Nexus APTs, and crucial defensive strategies. It serves as a critical resource for cybersecurity professionals seeking to understand and mitigate similar threats, emphasizing the importance of focusing on adversary behaviors and "human fingerprints" for effective threat intelligence and defense.

Background

▶ Watch: Initial discovery via open directory and Nuclei scans (1:30)

SAP NetWeaver serves as a foundational technology for numerous enterprise applications, underpinning critical business processes across various sectors, including finance, logistics, and human resources. Its widespread deployment in corporate networks, often with public-facing interfaces, makes it an attractive target for adversaries seeking high-value access. The vulnerability at the heart of this campaign specifically exploited an API within the NetWeaver metadata uploader component. This particular API allowed an unauthenticated attacker to upload arbitrary files, which the China Nexus APT group weaponized to deploy a webshell. Once deployed, the webshell provided a persistent backdoor, enabling remote code execution and serving as the beachhead for further malicious activities.

The discovery of this campaign originated from an unusual source: an open directory infrastructure hosted on a specific IP address. In April 2025 (as stated in the transcript), EclecticIQ analysts identified this publicly accessible directory, which contained a trove of compromised data. Among these files were detailed lists of SAP NetWeaver servers that had been successfully exploited and subsequently backdoored with webshells. These lists, notably found in both Chinese and English language versions, provided crucial initial telemetry into the scope and nature of the attacks. The Chinese language file, when translated, was notably named "service data," hinting at the strategic intent behind the compromises.

Further analysis of the open directory revealed that the threat actors were actively using the Nuclei tool for automated scanning. Nuclei, an open-source, template-based vulnerability scanner, allowed the attackers to efficiently identify vulnerable SAP NetWeaver instances across the internet. This initial automated phase was critical for casting a wide net, but as Büyükkaya highlighted, the campaign quickly transitioned from these automated scans to more targeted, hands-on keyboard operations once initial access was secured. The motivation behind targeting SAP NetWeaver, particularly those used by utilities for functions like HR, was to gain strategic access that could facilitate lateral movement into core operational technology (OT) environments, such as water management utilities, VMware systems, IoT devices, and RDP systems, ultimately aiming for broader network compromise and cyber espionage.

Key Findings

▶ Watch: Web shells and Snowlight downloader for initial access (3:15)

Büyükkaya's investigation uncovered a pervasive and well-orchestrated campaign by China Nexus APT groups, yielding several critical findings regarding their operational scope, technical capabilities, and strategic objectives.

Firstly, the sheer scale of the compromise was significant: more than 500 SAP NetWeaver instances were found to have been successfully backdoored. This extensive victimology was directly observed from the adversary's own infrastructure, specifically the open directory containing lists of exploited servers. The presence of these lists in both Chinese and English indicated a methodical approach to tracking and managing compromised assets, with the Chinese list's title "service data" suggesting a specific operational context for the attackers.

Secondly, the talk meticulously detailed the multi-stage attack chain and malware ecosystem employed by the APT group. The initial breach, as previously noted, involved exploiting an SAP NetWeaver vulnerability to upload a webshell. From this webshell, the attackers deployed a series of increasingly sophisticated payloads:

• Snowlight Downloader (SLT): A bash script used to establish persistence and download further stages. It targeted various Linux variants and utilized vshell rat for execution.
• VShell RAT: An open-source, Go-based Remote Access Trojan (RAT) primarily developed and used by Chinese-speaking threat actors.
• GoReverse: An evasive tool designed to establish an SSH reverse shell. Its use of the SSH protocol and support for fileless execution made it particularly difficult to detect. GoReverse payloads were observed being delivered from Chinese servers, specifically Alibaba infrastructure.
• SuperShell C2 Framework: A sophisticated command-and-control (C2) framework, also previously associated with China Nexus APTs, which provided the attackers with a user-friendly interface for managing compromised systems and exfiltrating data.

Thirdly, strong attribution confidence to China Nexus APT groups was established through a confluence of technical and linguistic indicators. Key "human fingerprints" included:

• C2 Infrastructure: The observed C2 servers for GoReverse and SuperShell were consistently located in mainland China, utilizing Chinese IP addresses.
• Linguistic Artifacts: The victim lists, webshell documentation, and the SuperShell C2 interface were all primarily in Mandarin Chinese. The specific naming convention "service data" for victim lists also pointed to a Chinese origin.
• Tool Overlap and Historical Context: The exact malware types (Snowlight, GoReverse, SuperShell) and the C2 infrastructure patterns identified in this SAP NetWeaver campaign mirrored those documented in prior reports by Google's Threat Analysis Group (TAG) in March 2024. These previous intrusions, targeting F5 and ScreenConnect vulnerabilities, were explicitly attributed to Chinese nation-state actors, strengthening the confidence in the attribution for the SAP NetWeaver campaign. Mandiant and Google's research further linked these activities to contractors working for the Chinese Ministry of State Security (MSS), potentially explaining the "service data" nomenclature.

Finally, the strategic objective of these attacks was clearly identified as cyber espionage and intelligence gathering, with a focus on critical infrastructure. The APT group's post-exploitation activities included scanning for VMware systems, IoT devices, and RDP services, indicating a deliberate effort to pivot from initial access points (like HR systems running on NetWeaver) into deeper, more sensitive operational environments. This underscores a long-term strategic goal of gaining persistent remote access and exfiltrating data relevant to national interests.

Technical Deep Dive

▶ Watch: Identifying SuperShell C2 framework via GoReverse pivot (6:00)

The technical sophistication of the China Nexus APT campaign targeting SAP NetWeaver demonstrates a well-resourced and methodical adversary. The attack chain meticulously detailed by Arda Büyükkaya reveals a progression from initial reconnaissance and exploitation to establishing robust, multi-layered persistence and control.

The initial access vector was a critical vulnerability within SAP NetWeaver, specifically an abuse of an API in the metadata uploader. This flaw allowed the attackers to upload a webshell, a server-side script that provides a web interface for remote code execution. The webshell itself was documented in Chinese, serving as the initial foothold for the attackers to execute arbitrary commands on the compromised NetWeaver server. This step is crucial, as it transforms an unauthenticated vulnerability into persistent remote access.

Following the successful deployment of the webshell, the adversaries utilized common command-line utilities like curl and wget to download and execute subsequent payloads. The first observed stage was the Snowlight downloader, a bash script identified as SLT. This script's primary function was to ensure the persistent execution and installation of further malware. Büyükkaya noted that SLT was designed to target different Linux variants, indicating a broad applicability across various NetWeaver deployments. To ensure correct execution and persistence, the vshell rat was employed.

The VShell RAT is a significant component of the attackers' toolkit. It is an open-source, Go-based Remote Access Trojan (RAT) that has been documented and developed by Chinese developers. Its open-source nature allows for customization and avoids immediate detection by signatures tailored to proprietary malware. The use of a Go-based RAT is also notable for its cross-platform compilation capabilities, making it suitable for diverse Linux environments.

The campaign then progressed to deploying GoReverse, a highly evasive tool designed to establish an SSH reverse shell. Unlike traditional reverse shells that might use less common ports or protocols, GoReverse leverages the ubiquitous SSH protocol, making its traffic harder to distinguish from legitimate network activity. The speaker highlighted its evasiveness, partly due to its ability to support fileless execution, which helps it avoid detection by endpoint security solutions that monitor for dropped files. GoReverse payloads were observed being delivered from Chinese servers, specifically utilizing Alibaba Cloud infrastructure, reinforcing the geographical nexus of the attackers. The installation process involved downloading a configuration file, which further customized the GoReverse operation for specific targets.

Central to the APT group's command and control infrastructure was the SuperShell C2 framework. This framework, known for its use by other China Nexus APT groups, provides a comprehensive interface for managing compromised systems. Büyükkaya presented screenshots of the SuperShell user interface, which was primarily in Chinese, illustrating its capabilities for data exfiltration and remote management. The C2 infrastructure for SuperShell was consistently identified on Chinese IP addresses, further solidifying the attribution. The observed pattern of GoReverse communicating with the SuperShell C2 via the same Chinese infrastructure provided a crucial "human fingerprint" for linking disparate elements of the campaign. This integrated use of tools, from initial access to a sophisticated C2 platform, underscores the structured and deliberate nature of the APT group's operations.

Demo / Proof of Concept

▶ Watch: Attribution confidence: C2 infrastructure and human fingerprints (7:30)

While the talk did not feature a live, interactive demonstration of exploiting SAP NetWeaver in real-time, Arda Büyükkaya presented compelling evidence and visual proof-of-concept derived directly from the adversary's operations. This evidence served to illustrate the complete attack chain and the functionality of the tools described.

Key elements presented as proof included:

• Victimology Files: Büyükkaya showed screenshots and discussed the contents of the .txt files found in the adversary's open directory infrastructure. These files, specifically the Chinese and English versions, listed over 500 backdoored SAP NetWeaver instances, providing concrete evidence of the scale of compromise. The translation of the Chinese file's name to "service data" was also highlighted, offering insight into the attackers' internal nomenclature.
• Webshell Code Snippets: While not explicitly shown in detail during the rapid-fire presentation, the speaker mentioned the webshell being used for remote code execution and documented in Chinese, implying the existence of analyzed code or command outputs.
• GoReverse Installation: Visuals were provided detailing the installation process of the GoReverse payload. This included command-line output showing curl and wget being used in a specific, consistent order to download the payload and its configuration file from Chinese servers, particularly Alibaba Cloud. This demonstrated the delivery mechanism and the human fingerprint in the adversaries' operational style.
• SuperShell C2 Interface: A significant portion of the "demo" involved showcasing the SuperShell user interface. Büyükkaya displayed screenshots of the login page and the operational dashboard of the SuperShell C2 framework. These visuals clearly showed a Chinese-language interface, illustrating how the threat actors managed their compromised systems, exfiltrated data, and maintained persistence. The presence of a specific login page on the identified C2 IP address further validated its active use by the APT group.

These visual artifacts, directly sourced from the adversary's own infrastructure and operational traces, served as a robust "proof of concept" for the entire attack lifecycle, from initial scanning and exploitation to sophisticated command and control. They provided tangible evidence of the TTPs employed, reinforcing the analytical findings with concrete operational details.

Defensive Implications

▶ Watch: Actionable intelligence and key takeaways for disrupting attacks (10:10)

The detailed analysis of the China Nexus APT campaign targeting SAP NetWeaver provides critical intelligence for defenders across all sectors, especially those operating critical infrastructure. Understanding these TTPs is paramount for proactive defense.

Firstly, prioritizing the security of internet-exposed web applications is non-negotiable. SAP NetWeaver, like F5 and ScreenConnect (mentioned as similar exploitation targets in 2024), represents a high-value target when directly accessible from the internet. Organizations must conduct thorough asset discovery to identify all public-facing instances of such applications and ensure they are patched, securely configured, and protected by robust network perimeter controls (e.g., WAFs, IDS/IPS). Regular vulnerability assessments and penetration testing specifically targeting these applications should be a routine practice.

Secondly, defenders must implement robust threat modeling that accounts for sophisticated, multi-stage attacks. This includes not just preventing initial access but also detecting lateral movement, persistence mechanisms, and C2 communications. Monitoring for the specific tools and malware identified in this campaign—webshells, Snowlight downloader (SLT), VShell RAT, and GoReverse—is crucial. Endpoint Detection and Response (EDR) solutions should be tuned to detect Go-based executables, SSH reverse shells, and anomalous curl/wget activity, particularly when originating from web servers.

Thirdly, network telemetry and C2 infrastructure monitoring are vital. Organizations should actively monitor for connections to known malicious IP addresses, especially those identified as C2 servers in mainland China. The use of Alibaba Cloud for payload delivery is a specific indicator that can be integrated into threat intelligence feeds and network security policies. Anomalous SSH traffic, particularly outbound connections from internal systems to external, unknown IP addresses, should be flagged for immediate investigation.

Fourthly, focusing on adversary behaviors and "human fingerprints" is key for effective attribution and defense. Beyond generic malware signatures, understanding the specific command sequences (e.g., the consistent curl then wget order for payload delivery), the use of specific open-source tools, and linguistic artifacts (Mandarin Chinese in victim lists, webshells, and C2 interfaces) can provide high-fidelity indicators of compromise (IoCs) and aid in attributing attacks to specific APT groups. This behavioral intelligence allows defenders to anticipate future moves and build more resilient defenses.

Finally, the speaker emphasized the value of actionable intelligence derived from adversary infrastructure. The discovery of the open directory infrastructure containing victim lists was a game-changer, allowing EclecticIQ to contact affected parties and disrupt ongoing breaches. Organizations should consider leveraging open-source intelligence (OSINT) and external threat intelligence services to identify similar adversary staging grounds or data leaks that could provide early warnings of impending or ongoing attacks. This proactive approach, starting from telemetry derived from the attacker's own activities, can significantly enhance an organization's defensive posture and prevent future cyber intrusions.

Key Takeaways

• SAP NetWeaver as a Critical Attack Surface: Publicly exposed SAP NetWeaver instances are high-value targets for nation-state actors due to their role in critical corporate and infrastructure operations. Organizations must prioritize their security and patching.
• China Nexus APTs' Sophisticated TTPs: Adversaries are employing a multi-stage attack chain involving automated scanning (Nuclei), webshell deployment, and a suite of custom and open-source malware (Snowlight downloader, VShell RAT, GoReverse, SuperShell C2) for persistent access and cyber espionage.
• The Importance of "Human Fingerprints" for Attribution: Attribution confidence is significantly bolstered by combining technical indicators (C2 infrastructure in mainland China, Alibaba Cloud for delivery) with linguistic artifacts (Mandarin Chinese in victim lists, webshells, and C2 interfaces) and historical tool overlap with known APT campaigns.
• Strategic Targeting of Critical Infrastructure: The campaign aimed for strategic access to critical infrastructure, specifically water utilities, by using initial SAP NetWeaver compromises as a pivot point to target VMware, IoT, and RDP systems.
• Leveraging Adversary Infrastructure for Intelligence: Open directory infrastructures and other adversary-controlled assets can provide invaluable telemetry, offering early insights into victimology, tooling, and ongoing attack campaigns, enabling proactive disruption.
• Actionable Intelligence Disrupts Attacks: Timely analysis and dissemination of threat intelligence, including contacting affected victims, can directly lead to the disruption of ongoing attacks and prevent future cyber intrusions.

About the Speaker(s)

Arda Büyükkaya is a Senior Cyber Threat Intelligence Analyst at EclecticIQ. In his role, he focuses on dissecting sophisticated cyber threats and providing actionable intelligence to help organizations defend against advanced adversaries. His work involves in-depth analysis of adversary tactics, techniques, and procedures (TTPs), malware analysis, and attribution efforts, particularly concerning state-sponsored threat actors. Büyükkaya's presentation at CYBERWARCON underscores his expertise in tracking and reporting on the activities of China Nexus APT groups and their impact on critical infrastructure.