SAP Zero – Frostbite: How Russian RaaS Actor Qilin Exploited CVE-2025-31324 Weeks Before its Public Disclosure
CVE-2025-31324 hit the security world like a tsunami – an easily exploitable SAP vulnerability affecting enterprise environments across the globe. But while most assumed its exploitation began post-disclosure, new evidence suggests otherwise.
During an incident response led by OP Innovate for a major global enterprise, we uncovered proof that this vulnerability was actively exploited nearly three weeks before it was made public. While recent articles point the finger towards China-Linked APTs, we identified communication with known Cobalt Strike C2 infrastructure and IP addresses linked directly to Qilin, a notorious Russian-speaking Ransomware-as-a-Service group.
Pulse ID: 682cc36c603a5683307d027d
Pulse Link: https://otx.alienvault.com/pulse/682cc36c603a5683307d027d
Pulse Author: AlienVault
Created: 2025-05-20 18:01:16
Be advised, this data is unverified and should be considered preliminary. Always do further verification.
#China #CobaltStrike #CyberSecurity #InfoSec #OTX #OpenThreatExchange #RaaS #RansomWare #RansomwareAsAService #Russia #Vulnerability #bot #AlienVault
