Indicators of compromise · BianLian — 4 shown
198[.]100[.]154[.]163:8443162[.]243[.]6[.]201:944385[.]198[.]108[.]131:51227122[.]51[.]212[.]92:39904
Defanged third-party indicators (abuse.ch). The defanging is deliberate: never click, resolve or fetch these values. An indicator corroborates a report — it never proves one, and its presence here does not mean this story's hosts are listed.
CVE-2025-31324 — SAP NetWeaver Flaw
Summary
CVE-2025-31324 is a prior SAP NetWeaver vulnerability that has been weaponised by both China-nexus espionage clusters (UNC5221, UNC5174) and cybercrime groups (BianLian, RansomExx). It is referenced in the 2026-08-16 digest as the historical precedent for why a critical SAP Commerce Cloud flaw (Cve 2026 58231 Sap Commerce Cloud Rce) is expected to be rapidly weaponised.
Key Details
- Vendor: SAP NetWeaver
- Weaponised by: China-nexus espionage clusters (UNC5221, UNC5174) and cybercrime groups (BianLian, RansomExx)
- Context: Demonstrates that critical SAP flaws attract both state-sponsored and financially motivated attackers
Significance
The dual-use exploitation of CVE-2025-31324 — by state espionage and ransomware groups alike — is the basis for the high-risk assessment of Cve 2026 58231 Sap Commerce Cloud Rce in the 2026-08-16 digest, even before confirmed victim compromise.
Australian Relevance
Australian organisations running SAP estates should treat the critical SAP exploit pipeline as an active threat and prioritise Commerce Cloud patching under patch-promptness guidance.
Related
- Cve 2026 58231 Sap Commerce Cloud Rce — The critical SAP Commerce Cloud RCE assessed against this precedent