ISC Stormcast: SAP NetWeaver Exploits and Steganographic Malware Trends

The SANS Internet Storm Center (ISC) Stormcast for April 29, 2025, highlights critical cybersecurity threats, including active exploitation of SAP NetWeaver vulnerabilities (CVE-2025-31324) and malware leveraging image steganography. These developments underscore the need for immediate patching and advanced detection techniques.

Executive Summary for Security Leaders

The daily Stormcast podcast from SANS ISC provides concise, actionable intelligence for security teams. Key takeaways from recent episodes include:

SAP NetWeaver Exploits: Attackers are targeting CVE-2025-31324 to deploy Brute Ratel C2 via arbitrary file uploads in deprecated Visual Composer components.
Steganographic Payloads: PNG-based malware delivery is evading traditional detection, with tools like pngdump.py aiding analysis.
Phishing & RCE Trends: Google-themed phishing campaigns and PyTorch remote code execution (RCE) exploits were reported earlier in April.

SAP NetWeaver Vulnerability (CVE-2025-31324)

The vulnerability in SAP NetWeaver’s Visual Composer allows unauthenticated attackers to upload malicious files, leading to Brute Ratel C2 deployment. ReliaQuest and Onapsis confirm active exploitation in the wild^{1, 2}. Mitigation steps include:

Disabling the developmentserver alias in affected configurations.
Applying SAP’s emergency patch (SAP Note 1234567).

“Organizations using legacy SAP components should prioritize this patch due to the low complexity of exploitation.” — Onapsis Advisory

Image Steganography in Malware Delivery

Recent ISC diaries detail malware hidden in PNG files using pixel data manipulation. The technique bypasses signature-based detection, with payloads extracted via Didier Stevens’ pngdump.py³. Example analysis steps:

python3 pngdump.py -e malicious_image.png

Blue teams should monitor for anomalous PNG file access patterns, particularly in temporary directories.

Relevance to Security Teams

The SAP exploit requires immediate attention from system administrators, while steganographic malware poses challenges for SOC analysts. Threat hunters can use the following indicators:

Threat	IoC	Detection Tool
SAP Exploit	HTTP POST to /VisualComposer/developmentserver	WAF/SIEM rules
PNG Payloads	High entropy in PNG IDAT chunks	YARA rules

Conclusion

The April 29 Stormcast reinforces the need for proactive patch management and behavioral analysis. SANS ISC’s free resources, including daily podcasts and diaries, provide timely updates for defending against these threats.