Search — “82.26.72.21”

SANS ISC observed a campaign against SAP NetWeaver in honeypot data, with requests for /irj/servlet_jsp/irj/root/ant.jsp and many other upload and webshell paths from a single source, 82.26.72.21. The diary says the campaign exploits or searches for webshells left by CVE-2025-31324, an unauthenticated file upload flaw the diary describes as CVSS 10, and that webshells usually end up under /irj/servlet_jsp/irj/root/. Hunters should look for requests to ant.jsp or upload paths on SAP web servers and for unexpected files in that webroot; the source does not confirm any successful compromise.