Better Security, Together

A critical zero-day vulnerability in SAP NetWeaver Visual Composer (CVE-2025-31324, CVSS 10.0) is currently under widespread active exploitation. This unrestricted file upload vulnerability allows unauthenticated attackers to upload malicious files directly to SAP systems without authorization, potentially leading to full system compromise. SAP released an emergency patch on April 24, 2025, but exploitation was observed both before and after the disclosure.

The vulnerability specifically affects the Metadata Uploader component of SAP NetWeaver Visual Composer, where missing authorization checks in the /developmentserver/metadatauploader endpoint allow attackers to upload JSP webshells to publicly accessible directories. These webshells enable remote command execution, file uploads, and potential lateral movement throughout networks. Researchers have observed attackers using sophisticated tools such as Brute Ratel and the Heaven’s Gate technique for execution and evasion.

It is estimated that 50–70% of internet-facing SAP systems have the vulnerable component enabled, leaving a significant portion potentially exposed. The impact is substantial, with activity observed across numerous industries.

Security researchers have identified a financially motivated initial access broker (IAB) dubbed ToyMaker, operating since at least 2023, who compromises internet-facing servers to plant a custom backdoor named LAGTOY. ToyMaker then sells or hands over access to ransomware groups such as Cactus, who conduct double extortion attacks. This collaboration was observed when Cactus actors used credentials and footholds created by ToyMaker to spread laterally across a compromised critical infrastructure network, exfiltrate sensitive data, and deploy ransomware.

ToyMaker’s intrusion typically begins with exploiting unpatched, internet-facing servers. Upon gaining access, the actor rapidly conducts reconnaissance, creates unauthorized accounts, and deploys the LAGTOY backdoor. Credential harvesting is performed using Magnet RAM Capture, followed by archiving the dumps using 7zip and exfiltration over SCP via PuTTY’s pscp utility.

The LAGTOY malware establishes persistence as a service under the name WmiPrvSV, communicates with a hardcoded C2 over raw TCP port 443, and supports executing commands remotely. It features anti-debugging measures using a custom unhandled exception filter and a time-based execution control to evade detection.

After a short dormancy period, ToyMaker transferred access to Cactus ransomware operators. Cactus then conducted further reconnaissance, moved laterally using stolen credentials, installed remote administration tools (AnyDesk, RMS, eHorus, OpenSSH), exfiltrated sensitive data using 7zip and curl, and finally deployed ransomware across the environment.