How Attackers Use SAP RFC to Move Laterally Across Environments

Understanding SAP RFC and Its Security Implications

SAP Remote Function Call (RFC) is a communication interface that enables SAP systems and external programs to invoke functions and exchange data in real time. While RFC facilitates critical inter-system workflows, its inherent trust model and extensive privileges create a large attack surface for adversaries.

RFC connections are often configured with predefined trusted communication channels, allowing seamless execution of remote tasks without repeated authentication prompts. This convenience, however, poses significant risk when credentials or connections are compromised.

Malicious actors exploit unsecured or misconfigured RFC connections to gain unauthorized access, move laterally across SAP ERP, S/4HANA, and SAP Business Technology Platform (BTP) environments, and perform illicit transactions.

Types of RFC Connections Exploited

• Type 3 (ABAP RFC): Allows communication between SAP systems or SAP systems and external ABAP programs.
• Type T (Transactional RFC): Supports asynchronous transaction-oriented communication.
• Type Q (Queued RFC): Ensures ordered processing via queue mechanisms.

Attackers typically target Type 3 RFCs due to their synchronous nature and high privilege allowances.

Risks Inherent in RFC Usage

• Authorization Misconfigurations: Excessive or incorrect RFC user privileges facilitate unauthorized access.
• Unsecured Communication: Lack of encryption or proper authentication exposes data and controls to interception.
• Trust Relationship Abuse: RFC destinations trusted without adequate restrictions allow lateral propagation.

Attackers’ Lateral Movement Techniques Using SAP RFC

Once inside a single SAP system, threat actors use RFC to pivot laterally, leveraging compromised accounts and trust paths to explore additional systems and escalate access across the SAP landscape.

1. Credential Harvesting and Privilege Escalation

Attackers often capture or brute-force RFC user credentials that have broad permissions. These credentials may belong to technical users or service accounts frequently overlooked in security audits.

With elevated privileges, adversaries can manipulate RFC destinations, create new RFC connections, or inject malicious function modules facilitating further access escalation.

2. Abusing Trust Relationships Between Systems

RFC destinations configured with “trusted” flags permit users from one system to invoke functions on another without additional logins. Attackers exploit these to hop from one SAP instance to another without triggering authentication challenges.

By modifying the configuration of RFC destinations or adding rogue entries, attackers can extend their reach across multiple SAP environments within the organization.

3. Deploying Malicious RFC-Enabled Programs

Adversaries may deploy or inject backdoors via custom RFC-enabled function modules or programs that execute attacker-controlled logic remotely.

Such payloads can facilitate data exfiltration, transaction tampering, or system configuration changes while masquerading as legitimate RFC activity.

4. Evasion of Detection Through Native RFC Activity

Using authorized RFC users and connections allows attackers to blend malicious actions into normal SAP traffic, evading traditional SIEM and audit mechanisms.

Attackers exploit this by mimicking typical RFC call patterns or executing commands only during off-peak hours to avoid triggering alerts.

Detecting and Mitigating RFC-Based Lateral Movement

Effective defense against lateral movement through SAP RFC requires layered controls, visibility, and continuous assessment of the SAP authorization and configuration landscape.

Comprehensive Authorization and Segmentation Reviews

Regular review of RFC users and their permissions is essential to enforce least privilege and reduce attack surface. Segmentation of SAP systems and restricting RFC destinations based on business needs limits lateral propagation.

Real-Time Monitoring of RFC Traffic

SAP audit logs and network monitoring systems need integration for real-time visibility into RFC calls, identifying anomalous patterns such as unusual endpoints, times, or function usage.

Enhancing SAP GRC and Separation of Duties Controls

SAP Governance, Risk, and Compliance (GRC) tools should be configured to flag potentially risky RFC functions and enforce segregation of duties policies. Continuous change monitoring helps detect unauthorized modifications in RFC configurations.

Strengthening Authentication and Encryption Mechanisms

Implement strong authentication for RFC users, including multi-factor methods where possible. Encrypt RFC communication channels using SNC (Secure Network Communications) to prevent interception or man-in-the-middle attacks.

SAP RFC Exploitation Use Cases and Attack Chains

Real-world incidents demonstrate how attackers chain initial breach vectors with SAP RFC abuse for deeper infiltration:

• Insider Threats: Employees with legitimate RFC access deploying malicious transactions or exfiltrating data without raising immediate suspicion.
• Advanced Persistent Threats (APTs): External adversaries leveraging stolen RFC user credentials and manipulating trust between SAP systems to maintain persistent, hidden access.
• Supply Chain Attacks: Compromise of third-party systems with trusted RFC destinations enabling lateral intrusion into the primary SAP landscape.

Leveraging CyberSilo SAP Guardian to Secure RFC Interfaces

CyberSilo SAP Guardian provides comprehensive monitoring that detects suspicious RFC activity, misconfigurations, and potential lateral movement early.

By correlating authorization rule violations, segregation of duties conflicts, and ABAP vulnerability indicators, the solution mitigates risks posed by RFC-based attack vectors across SAP ERP, S/4HANA, and BTP.

Integration with enterprise SIEM platforms enhances detection capabilities and supports compliance with frameworks such as SOX, ISO 27001, PCI DSS, and GDPR, all critical for secure SAP operations.

For more insights on complementing SAP monitoring with broader security analytics, review our top 10 SIEM tools and discover cost-effective solutions in the SIEM tool cost guide.