Google: Clop Accessed “Significant Amount” of Data in Oracle EBS Exploit

Mandiant and Google are tracking a new extortion campaign where executives at multiple companies received emails claiming that sensitive data was stolen from their Oracle E-Business Suite systems. According to Genevieve Stark, Head of Cybercrime and Information Operations Intelligence Analysis at GTIG, the campaign began in late September. "This activity began on or before September 29, 2025, but Mandiant's experts are still in the early stages of multiple investigations, and have not yet substantiated the claims made by this group," Stark said. Charles Carmakal, CTO of Mandiant – Google Cloud, stated that the extortion emails are being sent from a large number of compromised email accounts. "We are currently observing a high-volume email campaign being launched from hundreds of compromised accounts and our initial analysis confirms that at least one of these accounts has been previously associated with activity from FIN11, a long-running financially motivated threat group known for deploying ransomware and engaging in extortion," Carmakal explained. In an example of the extortion email shared with BleepingComputer, Clop says they breached the company's Oracle E-Business Suite in a data theft attack. "We are CL0P team. If you haven't heard about us, you can google about us on internet," reads the extortion email shared with BleepingComputer. "We have recently breached your Oracle E-Business Suite application and copied a lot of documents. All the private files and other information are now held on our systems." "But, don't worry. You can always save your data for payment. We do not seek political power or care about any business. So, your only option to protect your business reputation is to discuss conditions and pay claimed sum." "In case you refuse, you will lose all abovementioned data: some of it will be sold to the black actors, the rest will be published on our blog and shared on torrent trackers." Mandiant and GTIG report, and BleepingComputer has confirmed, that the email addresses listed in the extortion email are the same as those on the Clop ransomware gang's data leak site, indicating a possible link to the extortion group. However, Carmakal says that while the tactics are similar to Clop's previous extortion campaigns and the email addresses indicate a potential link, there is not enough evidence to determine if data has actually been stolen. Mandiant and GTIG recommend that organizations receiving these emails investigate their environments for unusual access or compromise in their Oracle E-Business Suite platforms. After publishing this story, Clop claimed to BleepingComputer that they are involved in the extortion email, indicating a bug in Oracle's product was exploited in the attacks. However, the threat actors would not share more detailed information about the alleged attacks. "We not prepared to discuss details at this time," Clop told BleepingComputer. "Soon all will become obvious that Oracle bugged up their core product and once again, the task is on clop to save the day. We do not damage to systems and only expect payment for services we provide to protect hundreds of biggest companies in world." Oracle also published a brief post today by Rob Duhart, Chief Security Officer, Oracle Security, who said that they believe the threat actors exploited vulnerabilities patched in the July 2025 security updates. "Our ongoing investigation has found the potential use of previously identified vulnerabilities that are addressed in the July 2025 Critical Patch Update," explained Duhart. "Oracle reaffirms its strong recommendation that customers apply the latest Critical Patch Updates." If you have any information regarding this incident or any other undisclosed attacks, you can contact us confidentially via Signal at 646-961-3731 or at [email protected]. Who is the Clop extortion gang? The Clop ransomware operation, also tracked as TA505, Cl0p, and FIN11, launched in March 2019 when it began targeting enterprise networks with a variant of the CryptoMix ransomware. Like other ransomware gangs, Clop members breach corporate networks, steal data, and then deploy ransomware to encrypt systems. The stolen data and encrypted files are then used as leverage to force companies to pay a ransom demand in exchange for a decryptor and to prevent the leaking of the stolen data. While the group is still known to deploy ransomware, since 2020, they have shifted to exploiting zero-day vulnerabilities in secure file transfer platforms to steal data. Some of their most notable attacks include: 2020: Exploiting a zero-day in the Accellion FTA platform, affecting nearly 100 organizations. 2021: Exploiting a zero-day in SolarWinds Serv-U FTP software. 2023: Exploiting a zero-day in the GoAnywhere MFT platform, breaching over 100 companies. 2023: Exploiting a zero-day in MOVEit Transfer was Clop's most extensive campaign to date, where a zero-day exploit allowed data theft from 2,773 organizations worldwide. The most recent campaign associated with Clop was in October 2024, when the threat actors exploited two Cleo file transfer zero-days (CVE-2024-50623 and CVE-2024-55956) to steal data and extort companies. The U.S. State Department currently offers a $10 million reward through its Rewards for Justice program for information linking Clop's ransomware activities to a foreign government. Update 10/2/25: Added sample of Clop extortion email being sent to companies. Update 10/2/25 07:42 PM ET: Added statement from the Clop ransomware gang and further info from Oracle. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

FBI, UK gov’t urge orgs to patch Oracle E-Business vuln after alleged Clop campaign Oracle issued a security alert this weekend urging customers to patch a vulnerability currently being exploited by cybercriminals. Oracle’s security alert said CVE-2025-61882 impacts the Oracle E-Business Suite — a widely-used business platform containing several applications that manage finance, human resources and supply chain functions. Oracle explained that the vulnerability, which carries a severity score of 9.8 out of 10, could be exploited remotely “without the need for a username and password.” Customers need to install patches from an October 2023 update before installing the new patch issued on Saturday. Oracle also shared indicators of compromise that organizations can use to support their efforts to detect and contain potential breaches. FBI Assistant Director Brett Leatherman said “this is ‘stop-what-you’re-doing and patch immediately’ vulnerability.” “The bad guys are likely already exploiting in the wild, and the race is on before others identify and target vulnerable systems,” he said in a Sunday evening post on LinkedIn. “In plain terms: if your [E-Business Suite] environment is reachable on the network, and especially if it’s internet facing, it’s at risk for full compromise.” Leatherman added that Oracle E-Business Suite customers should isolate potentially affected servers and monitor threat intelligence channels because “exploit activity could escalate quickly.” “Oracle EBS remains a backbone ERP system for major enterprises and public-sector environments, which means attackers have every incentive to weaponize this one fast,” he explained. “If you suspect compromise - please connect with us.” Cybersecurity agencies in the U.K. and Singapore published their own advisories with similar guidance. The U.S. Cybersecurity and Infrastructure Security Agency added the bug to its Known Exploited Vulnerabilities catalog and ordered all federal civilian agencies to patch it by October 28. Mandiant chief technology officer Charles Carmakal tied CVE-2025-61882 to a campaign unveiled last week by the cybercriminal group Clop. The group is currently attempting to extort corporate executives by threatening to leak sensitive information they claim was stolen through the Oracle E-Business Suite. Oracle confirmed the campaign but initially said the hackers were exploiting bugs that had been addressed in a July update, without specifying which vulnerabilities were being used. On Sunday, Carmakal said Clop “exploited multiple vulnerabilities in Oracle [E-Business Suite] which enabled them to steal large amounts of data from several victims in August 2025.” “Clop has been sending extortion emails to several victims since last Monday. However, please note they may not have attempted to reach out to all victims yet,” he said. “Multiple vulnerabilities were exploited including vulnerabilities that were patched in Oracle's July 2025 update as well as one that was patched this weekend (CVE-2025-61882).” He added that organizations should “examine whether they were already compromised.” Several other cybersecurity experts confirmed that Clop has been exploiting multiple vulnerabilities in Oracle E-Business Suite since August. Jake Knott, principal security researcher at cybersecurity firm watchTowr, said exploit code for CVE-2025-61882 became public by Monday. Jonathan Greig is a Breaking News Reporter at Recorded Future News. Jonathan has worked across the globe as a journalist since 2014. Before moving back to New York City, he worked for news outlets in South Africa, Jordan and Cambodia. He previously covered cybersecurity at ZDNet and TechRepublic.

FBI warns of Scattered Spider and ShinyHunters attacks on Salesforce platforms Hackers connected to the Scattered Spider and ShinyHunters cybercriminal operations are extorting organizations for exorbitant ransoms after stealing data from Salesforce, the FBI warned. The agency released a flash notice on Friday with information about an ongoing data theft campaign that has impacted hundreds of businesses this year. The FBI refers to the hackers as both UNC6040 and UNC6395 and by their colloquial names of ShinyHunters and Scattered Spider, respectively. After months spent breaching some of the largest companies in the world, the hackers are now attempting to extort victim organizations — threatening to leak troves of customer data, business documents and more. The FBI did not say how many victims have received extortion emails demanding payment in cryptocurrency but they noted that the monetary demands have varied widely and are made at seemingly random times. Some extortion incidents were initiated days after data exfiltration while others took place months later. The FBI said the campaign began in October 2024 when members of the group gained access to organizations through social engineering attacks that involved contacting call centers and posing as IT employees. That scheme typically gave the cybercriminals access to employee credentials that were then leveraged to access Salesforce instances holding customer data. In other cases, the hackers used phishing emails or texts to take over employees’ phones or computers. The hackers evolved their tactics throughout the summer, switching to exploiting third-party applications that organizations linked to their Salesforce instances. “UNC6040 threat actors have deceived victims into authorizing malicious connected apps to their organization's Salesforce portal,” the FBI said. “This grants UNC6040 threat actors significant capabilities to access, query, and exfiltrate sensitive information directly from the compromised Salesforce customer environments.” By August, the hackers began targeting the Salesloft Drift application, an AI chatbot that can be integrated with Salesforce. The tactic allowed them to bypass traditional defenses like multifactor authentication, login monitoring and password resets, the FBI explained. In some cases, the FBI has found that the hackers created malicious applications within Salesforce trial accounts that allowed them to register connected apps without using a legitimate corporate account. On Monday, Reuters and the BBC confirmed that Kering — the French conglomerate that owns Gucci, Balenciaga and Alexander McQueen — was attacked by the same ShinyHunters cybercriminals. ShinyHunters told the BBC that it stole information connected to 7.4 million unique email addresses. The hackers told another news outlet that they stole the information in late 2024 but only began negotiating a ransom in June 2025. Last week, a critical government agency in Vietnam confirmed that millions of financial records were stolen in an attack claimed by ShinyHunters. The cybercriminals previously took credit for devastating campaigns targeting giants in the insurance, retail and aviation industries. The FBI provided indicators of compromise that potential victims can use to see whether they have been affected by the hacking campaigns and urged companies to train call center employees on the tactics used. The agency also said companies should limit the privileges of almost every employee account, enforce IP-based access restrictions, monitor API usage and more. Experts said the information provided by the FBI showed how sophisticated the actors are at abusing legitimate tools for nefarious purposes, like Azure cloud infrastructure, virtual servers, Tor exit nodes and proxy services to obfuscate their origin. Scattered retirement? The FBI notice came shortly after the group made several posts on Telegram claiming to be retiring. The group blamed a recent string of arrests, law enforcement activity and criminal convictions against members as their reason for ceasing the current operation. Cybersecurity experts were dubious about the disbanding claims, noting that cybercriminal operations often make similar claims before reconstituting under different names. Some theorized the hackers are likely going to enjoy the spoils of their recent extortion campaigns before returning to cybercriminal activity. Sam Rubin, a senior official with Palo Alto Networks’ Unit 42, said recent arrests may have prompted the group to lay low, but history says such activity is often temporary. “Groups like this splinter, rebrand, and resurface — much like ShinyHunters. Even if public operations pause, the risks remain: stolen data can resurface, undetected backdoors may persist, and actors may re-emerge under new names,” he said. “Silence from a threat group does not equal safety.” Jonathan Greig is a Breaking News Reporter at Recorded Future News. Jonathan has worked across the globe as a journalist since 2014. Before moving back to New York City, he worked for news outlets in South Africa, Jordan and Cambodia. He previously covered cybersecurity at ZDNet and TechRepublic.

FBI warns of Scattered Spider and ShinyHunters attacks on Salesforce platforms Hackers connected to the Scattered Spider and ShinyHunters cybercriminal operations are extorting organizations for exorbitant ransoms after stealing data from Salesforce, the FBI warned. The agency released a flash notice on Friday with information about an ongoing data theft campaign that has impacted hundreds of businesses this year. The FBI refers to the hackers as both UNC6040 and UNC6395 and by their colloquial names of ShinyHunters and Scattered Spider, respectively. After months spent breaching some of the largest companies in the world, the hackers are now attempting to extort victim organizations — threatening to leak troves of customer data, business documents and more. The FBI did not say how many victims have received extortion emails demanding payment in cryptocurrency but they noted that the monetary demands have varied widely and are made at seemingly random times. Some extortion incidents were initiated days after data exfiltration while others took place months later. The FBI said the campaign began in October 2024 when members of the group gained access to organizations through social engineering attacks that involved contacting call centers and posing as IT employees. That scheme typically gave the cybercriminals access to employee credentials that were then leveraged to access Salesforce instances holding customer data. In other cases, the hackers used phishing emails or texts to take over employees’ phones or computers. The hackers evolved their tactics throughout the summer, switching to exploiting third-party applications that organizations linked to their Salesforce instances. “UNC6040 threat actors have deceived victims into authorizing malicious connected apps to their organization's Salesforce portal,” the FBI said. “This grants UNC6040 threat actors significant capabilities to access, query, and exfiltrate sensitive information directly from the compromised Salesforce customer environments.” By August, the hackers began targeting the Salesloft Drift application, an AI chatbot that can be integrated with Salesforce. The tactic allowed them to bypass traditional defenses like multifactor authentication, login monitoring and password resets, the FBI explained. In some cases, the FBI has found that the hackers created malicious applications within Salesforce trial accounts that allowed them to register connected apps without using a legitimate corporate account. On Monday, Reuters and the BBC confirmed that Kering — the French conglomerate that owns Gucci, Balenciaga and Alexander McQueen — was attacked by the same ShinyHunters cybercriminals. ShinyHunters told the BBC that it stole information connected to 7.4 million unique email addresses. The hackers told another news outlet that they stole the information in late 2024 but only began negotiating a ransom in June 2025. Last week, a critical government agency in Vietnam confirmed that millions of financial records were stolen in an attack claimed by ShinyHunters. The cybercriminals previously took credit for devastating campaigns targeting giants in the insurance, retail and aviation industries. The FBI provided indicators of compromise that potential victims can use to see whether they have been affected by the hacking campaigns and urged companies to train call center employees on the tactics used. The agency also said companies should limit the privileges of almost every employee account, enforce IP-based access restrictions, monitor API usage and more. Experts said the information provided by the FBI showed how sophisticated the actors are at abusing legitimate tools for nefarious purposes, like Azure cloud infrastructure, virtual servers, Tor exit nodes and proxy services to obfuscate their origin. Scattered retirement? The FBI notice came shortly after the group made several posts on Telegram claiming to be retiring. The group blamed a recent string of arrests, law enforcement activity and criminal convictions against members as their reason for ceasing the current operation. Cybersecurity experts were dubious about the disbanding claims, noting that cybercriminal operations often make similar claims before reconstituting under different names. Some theorized the hackers are likely going to enjoy the spoils of their recent extortion campaigns before returning to cybercriminal activity. Sam Rubin, a senior official with Palo Alto Networks’ Unit 42, said recent arrests may have prompted the group to lay low, but history says such activity is often temporary. “Groups like this splinter, rebrand, and resurface — much like ShinyHunters. Even if public operations pause, the risks remain: stolen data can resurface, undetected backdoors may persist, and actors may re-emerge under new names,” he said. “Silence from a threat group does not equal safety.” Jonathan Greig is a Breaking News Reporter at Recorded Future News. Jonathan has worked across the globe as a journalist since 2014. Before moving back to New York City, he worked for news outlets in South Africa, Jordan and Cambodia. He previously covered cybersecurity at ZDNet and TechRepublic.

Researchers found a way to bypass recent mitigations for Spectre v2 speculative execution side-channel attacks and developed an exploit to leak secrets from Linux machines. The method works against Spectre v2 defenses on AMD and Intel processors that rely on sanitizing or isolating branch predictors, which researchers generically refer to as neutralization-based mitigations. Spectre v2 is also known as Branch Target Injection (BTI) and is a variant of the Spectre class of vulnerabilities. It exploits a processor's indirect branch predictor and causes it to mispredict the target of an indirect branch, leading to speculative execution along an attacker-influenced code path. Modern processors use branch prediction to guess the most likely execution path and speculative execution to run instructions along that predicted path before the branch outcome is known. Spectre v2 allows an attacker to manipulate the CPU's indirect branch predictor so that the processor speculatively executes instructions at an attacker-chosen location, which could expose sensitive data. With neutralization-based mitigations (eIBRS on Intel and Safe RET on AMD), there is a gap between the time the branch predictor is isolated and when it is used by the victim branch. Active Spectre v2 mitigations assume that an attacker cannot use to their advantage the time between cleaning the branch predictor state and using it. However, the researchers introduced a primitive that enables re-poisoning the CPU’s state after the cleaning but before it is used. Daniël Trujillo, a PhD student, and associate professor Mengjia Yan of the MIT Computer Science and Artificial Intelligence Laboratory (CSAIL) discovered a technique for exploiting this Time-of-Neutralization to Time-of-Use (TONTOU) window to extract sensitive data. “An attacker without any special access to read arbitrary memory from the system, including sensitive data such as hashed passwords,” Trujillo told BleepingComputer. The researchers developed an Interrupt Injection attack, where “unprivileged user programs can schedule timer interrupts to occur during kernel execution.” “Therefore, we can force the kernel to be redirected to the interrupt handler and use this handler to poison microarchitectural states within the post-neutralization window,” the researchers explain. The researchers found that interrupts occurring during the post-neutralization window can be used to poison the processor's indirect branch predictor, enabling attacks against all types of indirect branches. Mengjia and Trujillo tested the attack starting from the assumption that an attacker can run arbitrary, unprivileged code on a Linux target machine to leak data from the kernel. On an AMD Zen 2 host with the latest Spectre v2 mitigations, the two researchers successfully ran through all the stages of a TONTOU attack: neutralization, redirection, poisoning, and the use of the poisoned branch predictors. Successfully exploiting the issue requires overcoming several obstacles, including redirecting kernel control flow, precisely aligning interrupts with the post-neutralization window, and using the interrupt handler to poison the branch predictor entry associated with the target indirect branch. The researchers address these challenges through installing ‘timers’ to trigger hardware interrupts, frequent injection of interrupts, and via active and passive poisoning methods. The attack was tested on both Intel and AMD processors. On an AMD Zen 2 system running Linux version 6.14.0-37-generic with 16GB of RAM, the researchers showed it could leak arbitrary kernel memory at a rate of 5.47 bytes/s and 91.97% accuracy, including the contents of /etc/shadow, which stores password hashes. Across 10 test runs, the attack successfully located and extracted the file in five cases, with each attempt taking an average of 18 minutes. While the attack is also possible on Intel machines, they noted that additional software requirements make the task more complex. The researchers note that interrupt injection enables attacker-controlled poisoning of the Return Stack Buffer (RSB), causing speculative mispredictions of return targets. Because passive RSB pollution is less reliable, they combined interrupt injection with Inception, a previously disclosed attack that Daniël Trujillo helped develop. AMD has published an advisory today noting that the interrupt inject issue "appears to be associated" with how implementation on Linux of the Safe RET mitigation against potential information disclosure attacks. Daniël Trujillo and Mengjia Yan presented their findings today at the Black Hat USA security conference. They will also share the details at the USENIX Security 2026 between October 27 and 29. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

A suspected ransomware affiliate is posing as a ransomware recovery service called "Ransom Busters," contacting victims before the attacks become public and claiming it can provide decryption keys and delete stolen data for a fee. GuidePoint Security's Research and Intelligence Team (GRIT) disclosed this activity after responding to several recent ransomware attacks in which victims received emails from Ransom Busters offering to help recover from the attack. The messages were suspicious because they were sent to victims before the attacks became public, raising questions about how they knew about the cyberattacks in the first place. Ransom Busters claimed it exploited vulnerabilities in administrative panels used by ransomware-as-a-service (RaaS) operations, giving it access to encryption keys and data stolen from victims. The group offered to delete the stolen data from ransomware servers, including those belonging to DragonForce, Settra, and Anubis, for between $20,000 and $60,000. However, evidence from two incidents leads GRIT to believe Ransom Busters is likely not a true recovery firm, but the ransomware affiliate responsible for the attacks. In both cases, the attackers used the same software, including SoftPerfect Network Scanner, s5cmd, and the Remotely remote monitoring tool. They also utilized the same tactics, including creating a local backdoor account using the password 'Numlock!123' and the same attacker-controlled hostname, 'DESKTOP-BBETH6K'. GRIT says it observed overlapping activity across multiple RaaS operations and believes, with moderate confidence, that Ransom Busters is a single ransomware affiliate using its access to steal ransom payments from the ransomware gangs it works with. GRIT told BleepingComputer that it has not seen any victims pay Ransom Busters and discourages victims from doing so. However, in one incident involving Ransom Busters, the victim instead paid the RaaS operation behind the attack. The researchers say the victim's name and stolen data were not published on the ransomware operation's data leak site, and they found no evidence that Ransom Busters leaked the stolen data outside the RaaS environment. Ransomware negotiation firm Coveware confirmed to BleepingComputer that they too recently responded to at least one incident where the same group or individual contacted a victim. "This third party contacted the victim via email and claimed to have access to both the decryption key and the stolen data," Elizabeth Cookson, Senior Director of IR at Coveware, told BleepingComputer. Coveware says it has encountered similar "middlemen" using other names as far back as 2024, but says this activity is distinct from the typical "ambulance chasers" who contact victims only after their attacks have been publicly disclosed. "This type of interference on a non-public incident is much more concerning," Lizzie told BleepingComputer. Coveware says interference from a rogue party with access to stolen data increases risk for victims, as paying the ransomware operation may no longer ensure that everyone with access to the data will honor an agreement not to leak it. The company believes increased distrust within Ransomware-as-a-Service operations could lead to more of this behavior, as affiliates attempt to generate additional profits outside of normal revenue-sharing arrangements with ransomware operators. BleepingComputer has also previously warned that third-party ransomware recovery services create forum accounts and privately contact victims who publicly disclose ransomware infections, claiming they can decrypt affected files. However, those services generally approached publicly known victims, while Ransom Busters' knowledge of non-public incidents is far more concerning. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report