The Clop ransomware group likely began targeting Oracle E-Business Suite (EBS) instances as early as August 9, successfully exfiltrating a “significant amount” of data new insights from Google Threat Intelligence Group (GTIG) and Mandiant have revealed. An individual or group of people claiming to be working with the Clop ransomware was observed sending extortion emails to executives at several organizations since September 29. Google noted that the extortion campaign followed months of intrusion activity by the threat actor and exploitation of the zero-day CVE-2025-61882 began before patches were available. Similarities and Overlap with Clop Activities GTIG analysis, published on October 9, highlighted several indicators that Clop, also tracked as FIN11, was behind the extortion…