SAGEWAVE
SageWave is a malicious Java servlet filter observed in Oracle E-Business Suite intrusion chains analyzed by Google Threat Intelligence Group (GTIG) and Mandiant in 2025. It appeared in at least two distinct Java payload chains associated with exploitation of Oracle EBS, including activity linked by multiple reports to Cl0p-branded extortion operations and overlaps with FIN11 tradecraft, although definitive attribution was not established in all reporting. SageWave is installed by the in-memory dropper SageLeaf after being loaded through the SageGift loader, forming the nested SAGE chain: SageGift -> SageLeaf -> SageWave. The malware is described as fileless or memory-resident and capable of evading file-based detection. Its role is to establish persistent access on compromised networks and systems and to enable deployment of a further payload. Specifically, SageWave installs or allows installation of an AES-encrypted ZIP archive containing Java classes or an unknown next-stage malware payload, which researchers did not recover. The broader attack chain involved malicious XSL/XSLT template-based exploitation of Oracle EBS, and reporting also notes that the Java implants in this campaign communicated with command-and-control infrastructure using traffic disguised as TLS handshakes. High-confidence associated malware families in the same campaign include GoldVein/GoldVein.Java, SageGift, and SageLeaf. The observed targeting context was Oracle E-Business Suite environments at dozens of organizations affected by exploitation of CVE-2025-61882 and related Oracle EBS vulnerabilities.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
As with the zero-day vulnerability announced by Oracle last week – tracked as CVE-2025-61882... Mandiant initially noted that Cl0p abused known and patched vulnerabilities, but added last week that the group also exploited the CVE-2025-61882 zero-day. SOCRadar also wrote that the flaw had been exploited in the wild – Oracle issued a patch for it October 4 – and that a public proof-of-concept exploit had been released.
Groups observed using it
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
A loader named SageGift loads a dropper named SageLeaf, which in turn installs a Java servlet filter named SageWave that enables the threat actor to deploy the final payload.
They're using multi-stage Java implants with names like GOLDVEIN, SAGEGIFT, and SAGEWAVE that live entirely in memory and communicate back to C2 servers disguised as TLS handshakes.
Techniques & procedures
5 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 technique
Initial Access
Execution
1 technique
Execution
Persistence
1 technique
Persistence
Stealth
1 technique
Stealth
Command and Control
1 technique
Command and Control
The second payload delivered through malicious templates is actually a “nested chain of multiple Java payloads”. A loader named SageGift loads a dropper named SageLeaf, which in turn installs a Java servlet filter named SageWave that enables the threat actor to deploy the final payload.
Recent activity
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Malware family dropped as a payload in Oracle EBS exploitation campaigns, likely involved in data exfiltration or further compromise.
Malware used to establish persistent access to compromised networks and systems in the Oracle E-Business Suite attacks.
Malicious Java servlet filter used for persistence/backdoor behavior in the SAGE chain; installs an AES-encrypted ZIP containing Java classes (final payload not directly observed). Some variants gate execution on a specific X-ORACLE-DMS-ECID header and filtered HTTP paths.
SAGEWAVE is a malicious Java servlet filter/backdoor that enables the installation of additional malware via encrypted ZIP archives.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.