MexicanMafia SAP RFC SXPG_CALL_SYSTEM and SXPG_COMMAND_INSERT OS Command Execution

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•3

Detects the abuse of SAP RFC function modules SXPG_CALL_SYSTEM and SXPG_COMMAND_INSERT to execute arbitrary OS commands. This activity, observed in the Operation Escaneo campaign, indicates potential unauthorized system command execution via SAP application components, often leveraging specific ZREDTEAM modules or scripts.