Loading story…
A widespread extortion campaign has targeted executives at multiple organizations using Oracle's E-Business Suite, with attackers claiming to have stolen sensitive data from these systems. The campaign, which began on or before September 29, 2025, involves a high volume of emails sent from hundreds of compromised third-party accounts. These emails demand extortion payments and provide contact information that matches addresses listed on the Clop ransomware group's data leak site, suggesting a possible connection to the notorious threat actor. Security researchers from Mandiant and Google Threat Intelligence Group (GTIG) are actively investigating the claims, but as of now, there is no independent verification that any data has actually been stolen from Oracle E-Business Suite environments. The emails are highly targeted, reaching company executives and leveraging previously compromised email accounts, some of which have been associated with FIN11, another financially motivated threat group known for ransomware and extortion activities. The tactics used in this campaign closely resemble those previously employed by Clop, including the use of compromised accounts and public leak site contact details, but the group has not publicly claimed responsibility on its leak sites. Oracle has not responded to requests for comment, and there is no confirmation of any zero-day vulnerabilities being exploited in Oracle E-Business Suite as part of this campaign. Researchers emphasize that the credibility of the attackers' claims remains unproven, and organizations are urged to investigate their Oracle environments for signs of compromise or unusual access. The campaign's scale and sophistication highlight the ongoing threat posed by ransomware and extortion groups targeting enterprise software platforms. The incident has raised concerns among Oracle customers, many of whom are now conducting internal investigations to assess potential exposure. The use of hundreds of compromised accounts to distribute the extortion emails demonstrates the attackers' ability to orchestrate large-scale, coordinated campaigns. The incident also underscores the importance of monitoring for suspicious activity in critical business applications and maintaining robust incident response procedures. While the Clop group has a history of exploiting file-transfer services for mass data theft, such as the MOVEit breach in 2023, it remains unclear whether this Oracle campaign represents a similar level of compromise. Security experts continue to monitor the situation and advise vigilance among organizations using Oracle E-Business Suite. The lack of public confirmation from Clop and Oracle leaves many questions unanswered, but the campaign serves as a reminder of the persistent threat landscape facing enterprise IT environments. Organizations are encouraged to report any related incidents to law enforcement and share threat intelligence with trusted partners to help contain the potential impact.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
8 events from the most recent confirmed update back to the earliest known activity.
Reporting identified Harvard University and Envoy Airlines as organizations allegedly breached in the Oracle E-Business Suite campaign. The disclosure added named victims to the incident beyond earlier generic reports of targeted customers.
Oracle said the activity was tied to flaws already addressed in its July 2025 Critical Patch Update rather than a new zero-day. The company advised customers to apply the July patches and stated it saw no evidence of zero-day exploitation in the extortion campaign.
Oracle acknowledged that some E-Business Suite customers had received extortion emails claiming compromise. The company said it was investigating with security partners and urged affected customers to seek support.
By October 3, reporting indicated that at least one targeted company had confirmed data theft connected to the campaign. This marked the first reported victim-side confirmation beyond the attackers' unverified claims.
Security reporting said the attackers were demanding seven- and eight-figure payments, with some outlets citing demands as high as $50 million. The extortion messages allegedly included screenshots and file trees as proof, though that evidence had not been independently verified.
Google Mandiant and Google Threat Intelligence Group began tracking the campaign as attackers used Clop-linked contact details and at least one sender account associated with FIN11. Investigators said attribution and the claimed data theft were not yet confirmed.
A mass extortion campaign targeting executives at organizations using Oracle E-Business Suite began in late September 2025, with reporting placing the start on or before September 29. The emails were sent from hundreds of compromised accounts and claimed sensitive Oracle EBS data had been stolen.
Oracle's July 2025 Critical Patch Update fixed nine Oracle E-Business Suite vulnerabilities, including three remotely exploitable flaws that did not require credentials. Later reporting tied the extortion activity to customers that had not applied these updates.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
27 references tracked. Mallory keeps watching after this page renders.
linkedin.com
Open sourcecpomagazine.com
Open sourcecomputerweekly.com
Open sourcecybereason.com
Open sourcebankinfosecurity.com
Open sourcegovinfosecurity.com
Open sourcecyberscoop.com
Open sourcebleepingcomputer.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Oracle disclosed a critical zero-day vulnerability, CVE-2025-61882, in its E-Business Suite that was actively exploited by the Clop ransomware group to conduct a widespread data theft and extortion campaign. The vulnerability, which affects Oracle E-Business Suite, was addressed in a security advisory released on a Saturday, with Oracle urging customers to apply the patch immediately to mitigate the risk of compromise. Federal cyber authorities and threat intelligence researchers expressed heightened concern following Oracle’s announcement, as the flaw had been exploited for at least eight weeks before some victims received extortion demands. The Clop group leveraged this zero-day, along with other vulnerabilities previously addressed in Oracle’s July security update, to gain unauthorized access to enterprise resource planning (ERP) systems. Once inside, the attackers exfiltrated sensitive data and subsequently targeted executives with spear-phishing emails containing ransom demands, threatening to leak or misuse the stolen information. The Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2025-61882 to its known exploited vulnerabilities catalog, confirming its use in active ransomware campaigns. Oracle’s Chief Security Officer, Rob Duhart, updated customers via a blog post, providing indicators of compromise and emphasizing the urgency of patching. The FBI’s Cyber Division described the situation as an emergency, highlighting the critical role Oracle E-Business Suite plays in both public and private sector organizations and the high incentive for attackers to weaponize the vulnerability quickly. Security briefings noted that organizations running Oracle E-Business Suite were specifically targeted, with attackers using sophisticated spear-phishing tactics to maximize the impact of their extortion efforts. The campaign’s discovery has amplified concerns about the security of widely used ERP platforms and the increasing sophistication of ransomware groups like Clop. The incident underscores the importance of timely patch management and the need for organizations to monitor for indicators of compromise associated with this vulnerability. The attack has prompted a rapid response from both Oracle and federal agencies, with advisories and threat intelligence updates being disseminated to help organizations defend against ongoing exploitation. The event has also reignited discussions about the risks posed by zero-day vulnerabilities in critical business applications and the necessity for coordinated industry response. As the situation develops, organizations are advised to remain vigilant, apply all relevant security updates, and review their incident response plans to address potential data theft and extortion scenarios. The Clop group’s exploitation of this zero-day highlights the evolving tactics of ransomware actors and the persistent threat they pose to enterprise environments.
Jun 29, 2026
Cl0p ransomware operators launched a widespread extortion campaign targeting Oracle E-Business Suite (EBS) customers by exploiting a previously unknown zero-day vulnerability, later assigned CVE-2024-61882. The campaign began as early as July or August, with Google's threat intelligence team tracking the exploitation weeks before Oracle became aware of the issue. Attackers leveraged the vulnerability to gain unauthorized access to EBS environments, deploying sophisticated multi-stage Java-based implants such as GOLDVEIN, SAGEGIFT, and SAGEWAVE. These implants operated entirely in memory, making detection difficult, and communicated with command-and-control servers using traffic disguised as legitimate TLS handshakes. The payloads were stored directly in the EBS database, and attackers used compromised third-party email services to facilitate their operations. Once data was exfiltrated, Cl0p initiated mass extortion by sending emails to executives, threatening to release stolen information unless a ransom was paid. The attack pattern mirrored previous Cl0p campaigns, notably the MOVEit mass exploitation, indicating a strategic focus on widely used enterprise applications. Oracle responded by releasing emergency patches on October 4th, but by that time, many organizations had already suffered breaches and data theft. The campaign highlighted the risks associated with delayed vulnerability disclosure and patching in critical business applications. Security researchers emphasized the technical sophistication of the implants, which were designed to evade traditional endpoint detection and response (EDR) solutions. The incident underscored the importance of proactive threat intelligence and rapid patch management for organizations relying on Oracle EBS. Industry observers noted that the campaign's scale and impact were significant, with numerous enterprises affected globally. The use of in-memory implants and stealthy C2 communications represented an evolution in Cl0p's tactics, making incident response and forensic analysis more challenging. The attack also raised concerns about the security of third-party integrations and the broader supply chain within enterprise environments. Oracle's emergency response included not only patches but also guidance for detecting signs of compromise and mitigating further risk. The event served as a stark reminder of the persistent threat posed by ransomware groups targeting high-value enterprise software platforms. Organizations were urged to review their security posture, monitor for unusual activity in EBS environments, and apply patches without delay. The campaign's exposure prompted renewed calls for improved collaboration between software vendors, threat intelligence teams, and end users to reduce the window of opportunity for attackers.
Jun 29, 2026
The Cl0p ransomware group orchestrated a significant cyber extortion campaign by exploiting multiple vulnerabilities in Oracle E-Business Suite (EBS), including a previously unknown zero-day flaw tracked as CVE-2025-61882. According to reports, Cl0p leveraged these vulnerabilities to gain unauthorized access to EBS environments and exfiltrate large volumes of sensitive data from several organizations in August 2025. Security researchers, including Charles Carmakal, CTO at Mandiant, and CrowdStrike, confirmed that the attacks began on August 9, 2025, and were part of a coordinated effort targeting Oracle EBS customers. The attackers used the zero-day vulnerability to bypass security controls and escalate privileges within the affected systems, enabling them to steal confidential business information and customer data. The stolen data was then used as leverage in extortion attempts, with Cl0p threatening to publicly release or sell the information unless ransom demands were met. The campaign demonstrated a high level of sophistication, as Cl0p combined the exploitation of the zero-day with other known vulnerabilities to maximize their access and impact. Security advisories highlighted the critical nature of CVE-2025-61882, urging organizations to apply patches and implement additional security measures to protect their Oracle EBS deployments. The incident underscored the ongoing threat posed by ransomware groups exploiting enterprise software vulnerabilities, particularly those that remain unpatched or are not widely known. Oracle customers were advised to review their security posture, monitor for signs of compromise, and engage in threat hunting activities to detect potential intrusions. The attacks also prompted discussions about the importance of timely vulnerability disclosure and patch management in reducing the risk of large-scale data breaches. Industry experts noted that the Cl0p campaign was part of a broader trend of ransomware actors targeting business-critical applications to maximize extortion pressure. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) responded by adding the Oracle EBS zero-day to its Known Exploited Vulnerabilities catalog, emphasizing the urgency of remediation. Organizations impacted by the breach faced significant operational and reputational risks, as well as potential regulatory consequences due to the exposure of sensitive data. The incident served as a stark reminder for enterprises to prioritize the security of their ERP systems and to stay vigilant against evolving ransomware tactics. Security vendors and incident response teams collaborated to share indicators of compromise and mitigation strategies, aiming to limit the spread and impact of the Cl0p campaign. The exploitation of Oracle EBS by Cl0p highlighted the persistent threat of zero-day attacks and the need for robust, layered defenses in enterprise environments.
Jul 12, 2026