SAGELEAF
SAGELEAF is an in-memory Java dropper used in a multi-stage, fileless malware chain observed in Oracle E-Business Suite (EBS) intrusions tied to exploitation of CVE-2025-61882 and related Oracle EBS weaknesses. In the observed SAGE chain, a Base64-encoded reflective loader named SAGEGIFT launches SAGELEAF, which then installs SAGEWAVE, a malicious Java servlet filter that enables deployment of a final payload that researchers were unable to recover. Reporting describes SAGELEAF as an in-memory dropper with logging, and the broader SAGEGIFT → SAGELEAF → SAGEWAVE chain as sophisticated, multi-stage, fileless malware designed to evade file-based detection. The malware was embedded in malicious XSL payloads/templates used during exploitation of Oracle EBS, including abuse of XML Publisher template functionality. The campaign affected dozens of organizations and involved data theft and extortion emails using the Cl0p name. Google Threat Intelligence Group and Mandiant did not definitively attribute the activity, but identified links and malware overlaps with FIN11; other reporting noted hallmarks associated with Cl0p/Graceful Spider. The malware was used against Internet-exposed Oracle E-Business Suite environments rather than broad consumer endpoints. High-confidence related malware in the same campaign includes GOLDVEIN.JAVA, SAGEGIFT, and SAGEWAVE.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
A loader named SageGift loads a dropper named SageLeaf, which in turn installs a Java servlet filter named SageWave that enables the threat actor to deploy the final payload. | It has since been determined that hackers likely exploited known EBS vulnerabilities patched in July, likely along with a zero-day flaw tracked as CVE-2025-61882. The hacker groups ShinyHunters and Scattered Spider ... have published a proof-of-concept (PoC) exploit that appears to target CVE-2025-61882 ... according to Oracle, CVE-2025-61882 allows unauthenticated remote code execution. CrowdStrike has found evidence that exploitation of CVE-2025-61882 started on August 9.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
A loader named SageGift loads a dropper named SageLeaf, which in turn installs a Java servlet filter named SageWave that enables the threat actor to deploy the final payload.
Techniques & procedures
4 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 technique
Initial Access
Execution
1 technique
Execution
Stealth
1 technique
Stealth
Command and Control
1 technique
Command and Control
The second payload delivered through malicious templates is actually a “nested chain of multiple Java payloads”. A loader named SageGift loads a dropper named SageLeaf, which in turn installs a Java servlet filter named SageWave that enables the threat actor to deploy the final payload.
Recent activity
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Malware family dropped as a payload in Oracle EBS exploitation campaigns, likely involved in data exfiltration or further compromise.
In-memory dropper stage (with logging) in the SAGE infection chain used in Oracle EBS exploitation.
SAGELEAF is an in-memory dropper used to install SAGEWAVE, facilitating further malware deployment on compromised systems.
A dropper in the Oracle EBS malware chain that installs SageWave, facilitating deployment of the final payload. It is part of a sophisticated, multi-stage, fileless Java malware framework.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.