Chaya_004
Chaya_004 is a suspected Chinese threat actor linked by Forescout Vedere Labs to ongoing exploitation of the SAP NetWeaver Visual Composer vulnerability CVE-2025-31324. Reporting states the actor targeted vulnerable NetWeaver instances from at least late April 2025 and used web shells and backdoors, including SuperShell/Supershell, in these attacks. Forescout associated the actor with infrastructure hosting Supershell backdoors, often deployed on Chinese cloud providers, and with the use of multiple penetration-testing tools described as of Chinese origin. According to the provided reporting, Chaya_004 has been tied to large-scale compromise activity affecting SAP NetWeaver systems, with at least 581 instances reportedly backdoored, including organizations in critical infrastructure sectors in the United Kingdom, the United States, and Saudi Arabia, and with plans to target roughly 1,800 additional domains. The content characterizes Chaya_004 as a Chinese APT/threat group and notes that its activity occurred alongside other China-linked clusters also exploiting the same SAP flaw, including UNC5221, UNC5174, and CL-STA-0048.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- critical-infrastructure
- industrial
Tradecraft
1 distinct technique observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
1 malware family attributed to this actor across reporting.
Associated vulnerabilities
1 CVE this actor has used in observed campaigns. 1 of them exploited in the wild.
Recent activity
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
China-linked intrusion activity exploiting SAP NetWeaver RCE (CVE-2025-31324) and deploying Golang-based tooling (SuperShell).
Chaya_004 is a Chinese APT group reported to be actively exploiting SAP NetWeaver CVE-2025-31324, targeting critical infrastructure and enterprise systems.
Targeting SAP NetWeaver vulnerabilities for cyber-espionage, likely as part of broader Chinese APT activity.
Suspected China-linked activity cluster exploiting SAP NetWeaver (CVE-2025-31324) using infrastructure hosting Supershell backdoors and various pentesting tools.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.