SAGEGIFT
SageGift is a multi-stage, fileless Java malware component observed in Oracle E-Business Suite (EBS) intrusion chains tied to exploitation of Oracle EBS vulnerabilities, including activity associated with CVE-2025-61882. It is described as a Base64-encoded reflective loader, custom designed for Oracle WebLogic servers, and forms part of the nested SAGE infection chain: SageGift loads SageLeaf, an in-memory dropper with logging, which then installs SageWave, a malicious Java servlet filter used to establish persistent access to compromised networks and systems and enable deployment of a final payload. Reporting states the implants can live entirely in memory, evade file-based detection, and communicate with command-and-control infrastructure using traffic disguised as TLS handshakes. SageGift was identified by Google Threat Intelligence Group (GTIG) and Mandiant in attacks against public-facing Oracle EBS environments during a broader data-theft and extortion campaign affecting dozens of organizations. The campaign has been linked with varying confidence to Cl0p/FIN11-related activity, though GTIG stated it had not definitively attributed the attack to a specific threat group. No standalone indicators of compromise specific to SageGift were provided in the content.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
As with the zero-day vulnerability announced by Oracle last week – tracked as CVE-2025-61882... Mandiant initially noted that Cl0p abused known and patched vulnerabilities, but added last week that the group also exploited the CVE-2025-61882 zero-day. SOCRadar also wrote that the flaw had been exploited in the wild – Oracle issued a patch for it October 4 – and that a public proof-of-concept exploit had been released.
Groups observed using it
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
A loader named SageGift loads a dropper named SageLeaf, which in turn installs a Java servlet filter named SageWave that enables the threat actor to deploy the final payload.
They're using multi-stage Java implants with names like GOLDVEIN, SAGEGIFT, and SAGEWAVE that live entirely in memory and communicate back to C2 servers disguised as TLS handshakes.
Techniques & procedures
4 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
1 technique
Initial Access
Execution
1 technique
Execution
Stealth
1 technique
Stealth
Command and Control
1 technique
Command and Control
The second payload delivered through malicious templates is actually a “nested chain of multiple Java payloads”. A loader named SageGift loads a dropper named SageLeaf, which in turn installs a Java servlet filter named SageWave that enables the threat actor to deploy the final payload.
Recent activity
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Malware family dropped as a payload in Oracle EBS exploitation campaigns, likely involved in data exfiltration or further compromise.
A dropper malware family delivered in the Oracle E-Business Suite intrusion chains.
Base64-encoded reflective loader component in the SAGE infection chain delivered via XSL payloads in Oracle EBS exploitation.
SAGEGIFT is a custom loader for Oracle WebLogic servers, used to launch further in-memory malware such as SAGELEAF and SAGEWAVE.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.