Chinese State-Aligned Hackers Exploit Zero-Day in SAP NetWeaver to Breach Global Enterprises
A newly discovered, high-severity flaw in SAP NetWeaver Application Server is being actively exploited by a Chinese nation-state threat group, marking a serious escalation in targeted attacks on enterprise resource planning (ERP) systems. Researchers have confirmed that this zero-day vulnerability is under live exploitation in the wild.
Unpatched Systems Wide Open to Remote Code Execution
The flaw, catalogued as CVE-2023-7629, impacts various builds of SAP NetWeaver AS ABAP. It allows unauthenticated attackers to achieve remote code execution (RCE), bypassing all traditional access controls. Despite SAP’s emergency patch release last week, thousands of internet-exposed systems remain vulnerable.
This weakness stems from a defect in the Internet Communication Manager (ICM) module—the core handler of SAP’s HTTP traffic. Attackers are leveraging this gateway to slip through undetected.
Targeted Industries: Finance, Manufacturing, and Beyond
Initial attacks have zeroed in on high-value targets—specifically, financial firms and manufacturers with sensitive trade secrets. Once access is gained, intruders are embedding themselves within networks, stealing data, and degrading operations. Several organizations have reported notable financial and operational damage.
New Malware Strain “SAPphire” Reveals Deep SAP Knowledge
Forescout’s threat researchers uncovered a tailored malware variant, dubbed SAPphire, embedded in these intrusions. SAPphire establishes encrypted command-and-control (C2) links by abusing legitimate SAP protocols—making the malware nearly invisible to traditional detection tools.
The campaign’s tactics indicate deep familiarity with SAP’s internal mechanisms—suggesting the attackers have invested significant resources in mastering ERP-specific exploitation.
Anatomy of the Attack: Precision Engineered for Persistence
The attack chain begins with a malformed HTTP request aimed at SAP’s ICM, triggering a memory corruption flaw that grants code execution. The following payload, cleverly embedded in a SOAP request to the RFC_READ_TABLE function, bypasses input validation using format string injections:
http
POST /sap/bc/soap/rfc HTTP/1.1
Host: target-sap-server
Content-Type: text/xml
Content-Length: 1337
Connection: keep-alive
… %s%s%s
Once activated, this malicious input opens a reverse shell—allowing attackers to install additional malware, modify SAP services, and schedule automated jobs to ensure persistent access.
Broader Risks: Supply Chain Exposure and Sector-Wide Fallout
The scope of this operation goes far beyond initial victims. Compromised SAP systems may act as springboards for attacks on trusted partners and suppliers, introducing a severe supply chain risk.
Organizations in government, healthcare, and infrastructure sectors are among the most exposed, as many rely on SAP as the backbone of mission-critical operations. Some enterprises have already been forced to shut down core environments to apply emergency mitigations.
Technical Breakdown: HTTP Smuggling + Memory Corruption
At its core, the attack relies on HTTP request smuggling to bypass network-layer defenses and reach the vulnerable ICM component. From there, the memory corruption enables the transition from exploitation to long-term compromise.
