Cl0p Ransomware Exploits Oracle E-Business Suite Zero-Day Vulnerability

Cl0p ransomware operators exploited a previously unknown zero-day vulnerability in Oracle E-Business Suite (EBS), enabling unauthorized access to the networks of major organizations, including Cox Enterprises. The attackers leveraged this flaw between August 9-14, 2025, to steal sensitive data before Oracle released a patch on October 5. Cox Enterprises detected the breach in late September and subsequently notified affected individuals after confirming that personal data had been exposed. The Cl0p group later published the stolen information on their dark web extortion portal, listing Cox among 29 new victims.

This campaign is part of a broader wave of attacks by Cl0p, which has a history of targeting widely used enterprise platforms through zero-day vulnerabilities. Other high-profile victims in this Oracle EBS campaign include Michelin, Canon, Mazda, Estée Lauder, Broadcom, and even Oracle itself. The group’s tactics mirror previous operations against MOVEit Transfer, GoAnywhere MFT, and Cleo file transfer tools, involving data theft followed by public leaks and extortion attempts. The scale and rapid escalation of the Oracle EBS campaign highlight the ongoing threat posed by Cl0p’s exploitation of critical enterprise software vulnerabilities.