cleo

The Cl0p ransomware group has named more than 40 organizations allegedly targeted in the recent campaign that exploited a vulnerability in PTC’s product lifecycle management (PLM) platforms Windchill and FlexPLM. The vulnerability and its exploitation The exploitation of the vulnerability, tracked as CVE-2026-12569, came to light in June, when CISA added it to its KEV catalog and the vendor warned of attacks targeting it. The flaw is an improper input validation issue that allows a remote, unauthenticated attacker to achieve arbitrary code execution via specially crafted requests. Exploitation of the vulnerability was expected, with police in Germany reportedly alerting organizations about imminent attacks. It’s worth noting that CVE-2026-12569 is the first ever Windchill vulnerability to be exploited in the wild. The cybersecurity industry reported seeing exploitation of the PLM product flaw in Cl0p ransomware attacks in late July. Cl0p affiliates exploited the security hole to deliver web shells that gave them access to the data of organizations using Windchill. Security firm ReliaQuest reported on Tuesday that Cl0p has been using a custom implant designed to provide “full data theft capability” without requiring additional tools. “[The web shell] maps sensitive vault data, decrypts every credential in the Windchill keystore, and includes a custom Java class loader that lets Clop execute any additional code inside the application process, extending the shell into an unlimited backdoor for follow-on activity such as lateral movement, ransomware, or persistence,” ReliaQuest explained. Cl0p attacks The Cl0p cybercrime gang initially only listed partial company names on its website, but on August 12 it started releasing alleged victims’ full names. More than 40 organizations apparently targeted in the Windchill campaign have been named to date. For each victim, the hackers listed the type and amount of information they have stolen. The type of exfiltrated data includes databases, project files, backups, photographs and other image files, engineering documents, blueprints, diagrams, logs, and other corporate documents. The amount of stolen information per organization ranges between 1 GB and several terabytes, according to the hackers. The compromised files could contain sensitive personal information and valuable intellectual property, but much of it may be of little value and already in the public domain, which is why many of the targeted organizations have likely refused to pay a ransom. The list of alleged victims includes oil and gas giant Shell, tech giant Philips, fintech giant Fiserv, enterprise mobility provider Zebra Technologies, industrial equipment manufacturer Ingersoll Rand, point-of-sale software maker Toast, global medical technology leader Mindray, and key Apple camera lens supplier Largan Precision. GE was initially listed as well, but it has since been removed from the Cl0p website, which could indicate that the company has agreed to pay a ransom or has resumed negotiations with the hackers. Companies such as Shell, Philips, Fiserv and GE stated that they are aware of the claims and are investigating, but none has confirmed a significant data breach. Cl0p previously conducted similar data theft and extortion campaigns targeting vulnerabilities in Oracle E-Business Suite, MOVEit, Cleo, and GoAnywhere software. Related: CareCloud Data Breach Impact Grows to 3.7 Million Individuals Related: Heights Finance Data Breach Impacts at Least 1.2 Million Individuals Related: 680,000 Impacted by French Tax Authority Data Breach

A custom Java web shell likely linked to the Clop ransomware gang was designed specifically for PTC Windchill and FlexPLM servers, with built-in features to decrypt credentials, enumerate file repositories, and steal files. Cybersecurity company ReliaQuest analyzed the web shell after it is believed to have been deployed in recent data theft attacks exploiting CVE-2026-12569, a critical remote code execution vulnerability affecting PTC Windchill. ReliaQuest says the implant is not a generic web shell repurposed for the attacks, but was instead built with detailed knowledge of Windchill's internal APIs, database schema, keystore, and file-vault structure. "This appears to be an application-specific evolution of Clop's established mass-exploitation playbook," ReliaQuest said in a report shared with BleepingComputer. The researchers say they found the web shell during the intelligence collection process. The researchers say the activity is likely linked to Clop based on extortion emails containing addresses used on the ransomware gang's data leak site, previously observed X-windchill-req headers also used in the web shell, and TTps commonly used by the threat actors. The Clop extortion gang has a long history of breaching enterprise platforms in data theft attacks, with previous campaigns targeting Accellion FTA, GoAnywhere MFT, SolarWinds Serv-U FTP, Cleo, and MOVEit Transfer file-sharing servers, the latter affecting more than 2,770 organizations worldwide. As BleepingComputer reported in July, Clop targeted exposed PTC Windchill and FlexPLM servers in a data theft extortion campaign involving exploitation of CVE-2026-12569 and the deployment of JSP web shells. At the time, ReliaQuest said attribution was unconfirmed, but the attacks shared similarities with previous Clop data-theft campaigns targeting secure file-sharing applications. Ransom-ISAC later confirmed Clop activity associated with the attacks, including extortion emails sent to hundreds of employees at affected organizations and containing the gang's latest contact information. PTC began releasing fixes for CVE-2026-12569 on June 17, and CISA later added the vulnerability to its Known Exploited Vulnerabilities catalog following warnings of heightened threat activity. A web shell built specifically for Windchill Analysis by ReliaQuest and BleepingComputer confirms the tool was designed to target Windchill servers rather than act as a generic web shell. The malware is a JavaServer Pages (JSP) web shell that directly imports Windchill-specific classes, including MethodContext, WTConnection, and WTKeyStoreUtil. These classes allow the shell to use Windchill's own functions to access its database, decrypt stored credentials, and locate files stored in application vaults. "The web shell connects to Windchill's database through the application's own MethodContext and WTConnection classes, meaning its queries run under the application's existing database identity rather than through a separately configured attacker account," explains ReliaQuest. "As a result, database telemetry may attribute this activity to the application's normal service identity, limiting the value of alerts that rely solely on detecting new accounts or unexpected source hosts." The web shell is controlled using a custom protocol sent through the HTTP X-windchill-req header, which contains eight characters, with the first character specifying the command and the remaining seven matching a fixed value. The web shell supports the following commands: S – Steal Windchill secrets and configuration: Reads Windchill's LDAP configuration and uses the application's ownWTKeyStoreUtil.decryptProperty() function to decrypt the LDAP manager password and other encrypted application data. L – Map Windchill's file vault: Searches Windchill's database for filenames, storage paths, and file sizes. The results are written to a file namedflst.txt , which can then be retrieved by the attackers usingG command. D – Enumerate directories and retrieve files: Enumerates supplied paths and reads portions of files. G – Read a file: Retrieves the contents of a specified file. R – Delete a file: Deletes a specified file. J – Load and execute additional Java code: Passes a Base64-encoded ZIP archive and loads compiled Java bytecode directly into memory and executes it within the Windchill process. O – Identify the operating system: Returns the operating system name. E – Echo supplied data: Echoes data in theX-windchill-prm header to verify the webshell is responding. ReliaQuest says the web shell's vault enumeration is also designed specifically to query certain tables in Windchill's database. BleepingComputer's analysis shows that these tables are ApplicationData, FVITEM, FVMOUNT, and MasteredOnReplicaItem. The cybersecurity company recommends that organizations immediately patch vulnerable Windchill systems and look for unusual JSP files in Windchill directories, especially those containing reference to X-windchill-req. Organizations that suspect their Windchill servers were compromised should also change the LDAP manager password and other Windchill credentials, as they should be considered compromised. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Tech giants General Electric (GE) and Philips have also confirmed they're investigating claims that the Clop ransomware gang breached their systems and stole data. While a GE spokesperson said the company is aware of the claim and is "working to assess the potential issue," a Philips spokesperson confirmed its systems were breached but said the incident has been contained and didn't affect customers. "Philips has identified and contained an attempted cybersecurity compromise of a specific enterprise server related to internal data," Philips said in a statement shared with Reuters. "This has no impact on customer environments." GE and Philips spokespersons have yet to reply after BleepingComputer also reached out to them for more details and to confirm the Clop ransomware gang's claims. This comes after oil giant Shell also said on Friday that it is investigating a potential security incident after the Clop hacking group claimed it stole 89GB of data. "We are aware of a potential incident," a Shell spokesperson told BleepingComputer when asked to confirm the gang's data theft claims. "We are working with our security teams and relevant experts to investigate. While the three companies have yet to share more information, the Clop gang has listed them on its leak site as part of a batch of 43 new victims likely targeted in data theft attacks exploiting a critical improper input validation vulnerability (tracked as CVE-2026-12569) against Internet-exposed PTC Windchill and PTC FlexPLM instances. PTC says the two enterprise software platforms are widely used by high-profile companies across the aerospace, defense, automotive, heavy machinery, retail, and medtech sectors. The company says more than 30,000 customers globally use its products, including over 1,500 brand and retail customers using FlexPLM. In these attacks, Clop claims it stole a wide range of sensitive data from the companies' compromised systems, including backups, project plans, photos of facilities, drawings, diagrams, blueprints, and more, belonging to Shell, GE, and Philips. PTC began releasing CVE-2026-12569 security patches on June 17 and urged customers to review environments for indicators of compromise (IOCs) in a private advisory, even though there was no confirmation of in-the-wild exploitation. Since then, cybersecurity company ReliaQuest and the Ransomware Information Sharing and Analysis Centre (Ransom-ISAC) have confirmed Clop's Windchill and FlexPLM attacks, in which the threat actors have been deploying JSP webshells to steal sensitive data from victims' compromised PLM platforms. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) also confirmed that the flaw is actively exploited in attacks after PTC warned of "heightened threat activity" on June 26, mandating federal agencies to secure their PTC Windchill and FlexPLM instances within three days after adding it to its catalog of known exploited vulnerabilities. This vulnerability has also prompted emergency action from German authorities, with the Federal Office for Information Security (BSI) warning PTC customers in the middle of the night to patch systems as quickly as possible. The Clop extortion gang has a long history of targeting enterprise platforms in data theft attacks, breaching Accellion FTA, GoAnywhere MFT, SolarWinds Serv-U FTP, Cleo, and MOVEit Transfer file-sharing servers in previous campaigns, with the latter affecting over 2,770 organizations worldwide. Starting in early August 2025, it also began exploiting an Oracle EBS zero-day flaw to steal sensitive files from many organizations. The list of victims includes many high-profile organizations worldwide, including The Washington Post, GlobalLogic, Harvard University, the University of Pennsylvania, Logitech, Estée Lauder, Korean Air, and American Airlines subsidiary Envoy Air. The U.S. Department of State now offers a $10 million reward for any information linking the cybercrime gang's attacks to a foreign government. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Cadena de vulnerabilidades críticas en WordPress, wp2shell 28/07/2026 Mar, 28/07/2026 - 11:33 A mediados de julio de 2026 se hizo pública una cadena de vulnerabilidades críticas que afectaba al núcleo de WordPress, posteriormente denominada wp2shell. El incidente tuvo su origen en dos fallos presentes en WordPress Core que, al combinarse, permitían a un atacante remoto ejecutar código sin necesidad de autenticarse ni de explotar plugins o temas adicionales. El equipo de WordPress coordinó la divulgación de la incidencia con los investigadores que la notificaron de forma responsable a través de su programa de recompensas, publicando simultáneamente versiones de seguridad para corregir el problema. La publicación de las actualizaciones marcó el inicio de la respuesta oficial frente a un riesgo que afectaba a instalaciones vulnerables del gestor de contenidos. Tras la publicación de los parches, diversas empresas de ciberseguridad confirmaron la explotación activa de la cadena de vulnerabilidades contra sitios que aún no habían sido actualizados. Los ataques observados consistían en la instalación de webshells, la creación de usuarios con privilegios administrativos y el despliegue de complementos maliciosos para mantener la persistencia en los sistemas comprometidos. Las versiones afectadas correspondían a determinadas ramas de WordPress 6.8, 6.9 y 7.0, mientras que el proyecto publicó las versiones correctoras 6.8.6, 6.9.5 y 7.0.2. Como medida adicional, el equipo de WordPress activó las actualizaciones automáticas forzadas para las instalaciones compatibles y recomendó a los administradores actualizar inmediatamente sus sitios, así como comprobar si habían sufrido una intrusión antes de aplicar únicamente el parche. En la actualidad, el estado del incidente es el de una vulnerabilidad corregida, con actualizaciones de seguridad disponibles para todas las ramas afectadas y con campañas de explotación documentadas contra sistemas que permanecían sin actualizar. El proyecto WordPress mantiene como recomendación oficial la instalación de las versiones corregidas mediante el mecanismo de actualización automática o manual, mientras que distintos organismos y entidades de ciberseguridad continúan alertando de la existencia de intentos de explotación sobre instalaciones vulnerables. Hasta la fecha, la información oficial difundida por WordPress se centra en la disponibilidad de las correcciones y en la necesidad de mantener los sitios actualizados, sin comunicar cambios posteriores respecto al alcance del incidente ni anunciar nuevas medidas adicionales relacionadas con esta cadena de vulnerabilidades.   Referencias 17/07/2026 wordpress.org WordPress 7.0.2 Release 18/07/2026 seguridadenwordpress.com wp2shell: la RCE de WordPress que afecta tu hosting 19/07/2026 cisoadvisor.com.br wp2shell: Un fallo crítico en el núcleo de WordPress permite la ejecución remota de código (RCE) 20/07/2026 securityweek.com WP2Shell WordPress Vulnerabilities Exploited in the Wild 22/07/2026 hispasec.com Una cadena crítica en WordPress facilita la instalación de webshells sin contraseña Etiquetas Actualización CMS Vulnerabilidad Wordpress

Google lidera la desarticulación de una de las mayores redes proxy residenciales del mundo 24/02/2026 Mar, 24/02/2026 - 11:17 A finales de enero de 2026, Google anunció la interrupción de una de las mayores redes de proxy residencial del mundo. La operación, liderada por Google Threat Intelligence Group, fue revelada públicamente a través de un comunicado oficial en el blog de seguridad de la compañía tras meses de seguimiento técnico y recopilación de inteligencia sobre la actividad de la red. La infraestructura desmantelada operaba a escala global y utilizaba dispositivos comprometidos para enrutar tráfico de Internet. El objetivo principal fue frenar el uso malicioso de millones de direcciones IP residenciales que estaban siendo explotadas para encubrir actividades ilícitas en línea. En el núcleo del suceso se encuentra la red conocida como IPIDEA, una infraestructura que convertía dispositivos domésticos en nodos de salida para terceros. Estos dispositivos eran integrados a la red mediante aplicaciones que incorporaban código proxy . Como consecuencia, millones de personas en distintos países pudieron haber visto su conexión utilizada para actividades como fraude digital, automatización abusiva de servicios o enmascaramiento de operaciones cibercriminales. Para contrarrestar la amenaza, Google obtuvo órdenes judiciales para intervenir dominios asociados al control de la red, bloqueó comunicaciones maliciosas y reforzó sus sistemas de detección en Android mediante Google Play Protect, con el fin de identificar y eliminar aplicaciones vinculadas a esta actividad. En la última actualización Google ha informado que la infraestructura principal de la red ha sido interrumpida y su capacidad operativa se ha visto significativamente reducida. No obstante, expertos en ciberseguridad advierten que este tipo de redes pueden reconfigurarse bajo nuevas estructuras o reaparecer con distintos nombres y métodos de distribución. Google ha señalado que continuará colaborando con proveedores de servicios, investigadores y autoridades internacionales para monitorear posibles reactivaciones y fortalecer la protección preventiva.  Referencias 30/01/2026 diario.elmundo.sv Google interrumpe la mayor red proxy residencial del mundo 30/01/2026 www.createwith.com Google Dismantles IPIDEA Residential Proxy Network 03/02/2026 www.larazon.es Google desconecta a 9 millones de móviles 'zombis': así operaba la red china que usaba tu Android para mover datos sin que lo supieras 05/02/2026 es.clickpetroleoegas.com.br Su teléfono parecía normal, pero estaba siendo utilizado por terceros en todo el mundo: Google desmantela un plan técnico que convirtió más de 9 millones de dispositivos Android en servidores proxy de Internet domésticos ocultos.

Dartmouth College has disclosed a data breach after the Clop extortion gang leaked data allegedly stolen from the school's Oracle E-Business Suite servers on its dark web leak site. The private Ivy League research university, founded in 1769, has an endowment of $9 billion as of June 30, 2025, over 40 academic departments and programs, and more than 4,000 undergraduate students, with a 7:1 undergraduate-to-faculty ratio. In a breach notification letter filed with the office of Maine's Attorney General, Dartmouth says the attackers exploited an Oracle E-Business Suite (EBS) zero-day vulnerability to steal personal information belonging to 1,494 individuals. However, the total number of people potentially impacted by this data breach is likely much larger, given that the school is headquartered in Hanover, New Hampshire, and it hasn't yet filed a breach notice with the state's Attorney General. "Through the investigation, we determined that an unauthorized actor took certain files between August 9, 2025, and August 12, 2025. We reviewed the files and on October 30, 2025, identified one or more that contained your name and Social Security number," the college says in letters mailed to those affected by the data leak. In a separate appendix filed with Maine's AG, Dartmouth added that the threat actors also stole documents containing the financial account information of impacted individuals. A Dartmouth College spokesperson was not immediately available for comment when contacted by BleepingComputer earlier today regarding the ransom demanded by the Clop gang and the total number of individuals impacted by the breach The incident is part of a much larger extortion campaign in which the Clop ransomware gang has exploited a zero-day flaw (CVE-2025-61882) since early August 2025 to steal sensitive files from many victims' Oracle EBS platforms. While Clop has yet to disclose the total number of impacted organizations, Google Threat Intelligence Group chief analyst John Hultquist has told BleepingComputer that dozens of organizations were likely breached. In the same campaign, the extortion group has also targeted Harvard University, The Washington Post, Logitech, GlobalLogic, and American Airlines subsidiary Envoy Air, with their data also leaked online and now available for download via Torrent. In the past, Clop has also been behind data theft attacks targeting Accellion FTA, GoAnywhere MFT, Cleo, and MOVEit Transfer, the latter impacting over 2,770 organizations. The U.S. Department of State now offers a $10 million reward for information tying the gang's attacks to a foreign government. In recent weeks, Ivy League schools have also been targeted by voice phishing attacks, with Harvard University, Princeton University, and the University of Pennsylvania disclosing that a hacker breached internal systems used for development and alumni activities to steal the personal information of students, alumni, donors, staff, and faculty members. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Cox Enterprises is notifying impacted individuals of a data breach that exposed their personal data to hackers who breached the company network after exploiting a zero-day flaw in Oracle E-Business Suite. The compromise occurred in August, but the company didn’t detect the intrusion until late September, when it launched its internal investigation. “On September 29, 2025, we became aware of suspicious activity involving Oracle’s E-Business Suite, which is a platform we use for some of our back-office business operations,” reads the notice. “We learned the suspicious activity was the result of cybercriminals taking advantage of a previously unknown security flaw (called a “zero-day” vulnerability) in Oracle’s E-Business Suite between Aug. 9-14, 2025.” Cox Enterprises is a major American conglomerate engaged in telecommunications (Cox Communications), and automotive services (Cox Automotive). The company has 55,000 employees and an annual revenue of $23 billion, with its businesses having an international reach. The company has not named the attackers, but the Cl0p ransomware has taken credit for exploiting CVE-2025-61882 as a zero-day vulnerability, long before Oracle released a patch on October 5. Cl0p hackers are known for leveraging zero-days in popular software products used by a large number of organizations. Incidents where Cl0p exploited unknown vulnerabilities include the Cleo file transfer in 2024, the MOVEit Transfer and GoAnywhere MFT in 2023, the SolarWinds Serv-U FTP in 2021, and the Accellion FTA in 2020. Breaches related to Oracle E-Business Suite have been confirmed by multiple companies, among them Logitech, Washington Post, GlobalLogic, Envoy Air, and Harvard University. The threat actor added Cox Enterprises to their data leak website on the dark web on October 27 and published the stolen information. Earlier today, Cl0p listed 29 new companies as their victims. The batch includes major organizations in the automotive, software, and technology sectors. In the notification to 9,479 impacted individuals, Cox provides instructions on how to enroll in identity theft protection and credit monitoring services through IDX at no cost for 12 months. The company did not specify what types of data were exposed in the notification sample shared with authorities. Update 11/22/25: Updated the article to remove reference to 2021 API vulnerability that incorrectly stated it was exploited by attackers. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Logitech discloses data breach after Clop claims Technology manufacturer Logitech filed documents with the Securities and Exchange Commission (SEC) on Friday about a recent cybersecurity incident that involved a zero-day vulnerability. The company told the SEC that an investigation revealed that hackers exploited a bug “in a third-party software platform and copied certain data from the internal IT system.” “The zero-day vulnerability was patched by Logitech following its release by the software platform vendor. The data likely included limited information about employees and consumers and data relating to customers and suppliers,” the company said, adding that the attack did not impact its products, business operations or manufacturing. “Logitech does not believe any sensitive personal information, such as national ID numbers or credit card information, was housed in the impacted IT system.” The attack will not have an impact on the company’s finances and plans to cover any costs with cyber insurance, the company noted. The filing comes one week after the Clop cybercriminal organization claimed it stole information from Logitech through a zero-day vulnerability in Oracle’s E-Business Suite tool. A spokesperson for Logitech declined to confirm whether the incident involved Clop or the zero-day impacting Oracle’s E-Business Suite. Reports from Google and other security firms indicate the hackers used a variety of vulnerabilities in Oracle E-Business Suite to gain access to sensitive data, including at least one zero-day vulnerability that was added to a federal watchlist in September. The Clop cybercriminal group initially attempted to extort corporate executives in October by threatening to leak sensitive information stolen through the application. Oracle confirmed the campaign but initially said the hackers were exploiting bugs that had been addressed in a July update, without specifying which vulnerabilities were being used. FBI Assistant Director Brett Leatherman said that one of the bugs exploited in the campaign is a “‘stop-what-you’re-doing and patch immediately’ vulnerability.” Since then, several organizations have come forward to confirm data theft incidents, including regional American airline Envoy Air and Harvard University. The Washington Post told regulators last week that nearly 10,000 people had information stolen as part of the breach. Since announcing that it was behind the exploitation of the zero-day affecting Oracle E-Business Suite customers, Clop has listed dozens of victims on its leak site. The Russia-based extortion group has earned hundreds of millions of dollars by exploiting unreported vulnerabilities in popular file transfer tools from Cleo, MOVEit, GoAnywhere and Accellion. Jonathan Greig is a Breaking News Reporter at Recorded Future News. Jonathan has worked across the globe as a journalist since 2014. Before moving back to New York City, he worked for news outlets in South Africa, Jordan and Cambodia. He previously covered cybersecurity at ZDNet and TechRepublic.

GlobalLogic, a provider of digital engineering services part of the Hitachi group, is notifying over 10,000 current and former employees that their data was stolen in an Oracle E-Business Suite (EBS) data breach. Based in Santa Clara, California, this software and product development services company was founded in 2000. Since then, it has expanded to 59 product engineering centers and several offices worldwide. In a breach notification letter filed with the office of Maine's Attorney General, the company states that the attackers exploited an Oracle EBS zero-day vulnerability to steal personal information belonging to 10,471 employees. "GlobalLogic's investigation identified access to Oracle and exfiltration on October 9, 2025. We then began drafting and sending out notifications. The investigation has identified the earliest date of threat actor activity as July 10, 2025, with the most recent activity occurring on August 20, 2025," it said. "This incident did not target or impact GlobalLogic's systems outside our Oracle platform, and, based on industry reports, we are one of many Oracle customers believed to have been impacted. The personal information involved in this incident was from our Oracle platform, which includes HR information for current and former personnel." The data stolen in the breach includes personal information collected by GlobalLogic's human resources and, depending on the affected individual, it includes name, address, phone number, and emergency contact (name and phone number). The attackers also exfiltrated the email addresses, dates of birth, nationalities, countries of birth, passport information, national identifiers or tax identifiers (e.g., Social Security Numbers), salary information, and bank account details of impacted employees. Clop's Oracle EBS data theft attacks While GlobalLogic has yet to attribute the breach to a specific threat group, the incident's details align with an extortion campaign in which the Clop ransomware gang exploited a zero-day flaw (CVE-2025-61882) since early August to steal sensitive data from many companies' Oracle EBS systems. Although Clop has yet to disclose the total number of companies affected by these data theft attacks, Google Threat Intelligence Group chief analyst John Hultquist has told BleepingComputer that they believe dozens of organizations were impacted. The extortion gang is now also targeting Harvard University, Envoy Air, and The Washington Post, who have all been added to the cybercrime group's Tor leak site. Their data has also been leaked online and is now available for download via Torrent. Clop has yet to add GlobalLogic to its leak site, which suggests that the company is still negotiating with the threat group or has already paid a ransom. A GlobalLogic spokesperson didn't respond to questions regarding Clop's demands, but confirmed the cybercrime gang "is taking credit for the incident." Clop has been previously linked to other data theft campaigns targeting Accellion FTA, GoAnywhere MFT, Cleo, and MOVEit Transfer, the latter of which has impacted over 2,770 organizations worldwide. The U.S. State Department now offers a $10 million bounty for information that links the ransomware gang's attacks to a foreign government. Update November 12, 03:48 EST: Added GlobalLogic statement. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Cybercriminals have named nearly 30 organizations allegedly impacted by the recent campaign targeting customers of Oracle’s E-Business Suite (EBS) enterprise resource planning solutions. The campaign, which involved extortion emails being sent to executives at dozens of organizations in late September, is believed to have been conducted by a cluster of a profit-driven threat actor tracked as FIN11. The attacks were claimed by the Cl0p (aka Clop) ransomware group. Cl0p was previously linked by the cybersecurity community to FIN11 and the decision to use it as the public-facing entity for the campaign was likely motivated by its prior involvement in similar high-impact campaigns targeting customers of Cleo, MOVEit, and Fortra file transfer products. Twenty-nine alleged victims of the Oracle EBS hack have been listed on the Cl0p leak website to date. The organizations that were the first to be named, such as Harvard University, South Africa’s Wits University, and American Airlines subsidiary Envoy Air, confirmed being impacted shortly after they were named by the attackers in mid-October. Last week, The Washington Post also confirmed it had been successfully targeted in the campaign, but did not share any details, Reuters reported. However, a majority of the other alleged victims have yet to confirm suffering a data breach. SecurityWeek has reached out for comment to several important organizations from the list, but none responded. This includes industrial giants Schneider Electric and Emerson, consumer electronics giant Logitech, communications and automotive giant Cox Enterprises, silver and gold producer Pan American Silver, automotive parts firm LKQ Corporation, and HVAC company Copeland. Other alleged victims include companies in the mining, professional services, wastewater, construction, insurance, financial, manufacturing, transportation, technology, automotive, energy, and HVAC sectors. The organizations impacted by the Oracle EBS hack are likely conducting investigations and some of them likely do not want to share any information until those probes are completed. Others, as past Cl0p attacks have shown, are likely trying to avoid the spotlight by staying silent. The cybercriminals leaked data allegedly stolen from 18 victims, in some cases making public hundreds of gigabytes and even several terabytes of files. SecurityWeek has conducted only a limited structural analysis of some of the leaked files and concluded that they likely originated from an Oracle environment. Given Cl0p’s history, it’s unlikely that organizations have been falsely listed as victims. However, it’s not uncommon for the cybercriminals to deliberately name parent companies as the victim when the actual impact was limited to a smaller subsidiary (as in the case of American Airlines being listed for the Envoy Air hack). It’s also possible that in some cases the hackers have exaggerated the value and sensitivity of the stolen data. It’s still unclear exactly which Oracle EBS vulnerabilities have been exploited in the campaign. The most likely candidates are CVE-2025-61882 and CVE-2025-61884, both of which can be exploited remotely without authentication or user interaction to gain access to sensitive data. In the case of CVE-2025-61882, exploitation as a zero-day appears to have started at least two months prior to patches being released. Related: Sophisticated Malware Deployed in Oracle EBS Zero-Day Attacks Related: State-Sponsored Hackers Stole SonicWall Cloud Backups in Recent Attack

The cybersecurity agency CISA has confirmed that an Oracle E-Business Suite (EBS) vulnerability patched earlier this month has been exploited in the wild. Dozens of Oracle customers have been targeted in a campaign that involved data theft from their EBS instances. The cybercriminals, presumably a cluster of a threat group named FIN11, stole significant amounts of files and attempted to extort victims. The attackers exploited EBS vulnerabilities to gain access to data, but Oracle and the cybersecurity community have yet to share definitive information on which flaws have been exploited. Oracle initially said known flaws patched in July were involved, and later announced that a zero-day tracked as CVE-2025-61882 was also apparently exploited in the campaign. A few days later, on October 11, the software giant announced fixes for CVE-2025-61884, which can be exploited remotely without authentication and without user interaction to gain access to sensitive data. However, Oracle’s advisory did not and still does not provide any indication that CVE-2025-61884 has been exploited in attacks. Only the timing of the patch suggested that CVE-2025-61884 too has been leveraged by the attackers. However, CISA on Monday added CVE-2025-61884 to its Known Exploited Vulnerabilities (KEV) catalog, confirming its exploitation. With the flaw added to CISA’s KEV catalog, federal agencies are required to apply mitigations by November 10. Bleeping Computer reported last week that CVE-2025-61884 corresponds to a PoC exploit leaked by Scattered Lapsus$ Hunter (a partnership between the Scattered Spider and ShinyHunters groups) shortly after the Oracle EBS hacking campaign came to light. It was initially believed that the PoC corresponds to CVE-2025-61882. Regardless of which vulnerabilities have been exploited as n-day or zero-day vulnerabilities, it appears that up-to-date Oracle EBS installations should no longer be susceptible to attacks, based on what Bleeping Computer learned from various security firms. The extortion emails sent to victims have been signed by the Cl0p group, which has gained notoriety over the past years, particularly as a result of similar campaigns targeting Cleo, MOVEit, and Fortra file transfer products through the exploitation of zero-day vulnerabilities. At the time of writing, four alleged victims of the Oracle EBS hack have been listed on the Cl0p ransomware leak website: Harvard University, American Airlines (subsidiary Envoy Air), South Africa’s University of the Witwatersrand, and industrial giant Emerson. Emerson is the only one of them that has yet to confirm being impacted and the company has not responded to SecurityWeek’s request for comment. Related: F5 Hack: Attack Linked to China, BIG-IP Flaws Patched, Governments Issue Alerts Related: Hackers Steal Sensitive Data From Auction House Sotheby’s Related: Organizations Warned of Exploited Adobe AEM Forms Vulnerability

Envoy Air, a regional airline carrier owned by American Airlines, confirms that data was compromised from its Oracle E-Business Suite application after the Clop extortion gang listed American Airlines on its data leak site. "We are aware of the incident involving Envoy's Oracle E-Business Suite application," Envoy Air told BleepingComputer. "Upon learning of the matter, we immediately began an investigation and law enforcement was contacted. We have conducted a thorough review of the data at issue and have confirmed no sensitive or customer data was affected. A limited amount of business information and commercial contact details may have been compromised." Envoy Air is a subsidiary of American Airlines and operates regional flights under the American Eagle brand. While it functions as a separate company, it is integrated into American's network for ticketing, scheduling, and passenger service. The Clop ransomware gang is now leaking what they claim to be the data stolen from Envoy on its data leak site, stating, "The company doesn't care about its customers, it ignored their security!!!" This new security incident is related to an August data theft campaign conducted by the Clop extortion group, which began emailing extortion demands to companies in September, claiming to have stolen data from Oracle E-Business Suite systems. While Oracle initially stated that the threat actors were exploiting vulnerabilities patched in July, the company later disclosed that the extortion gang exploited a zero-day flaw tracked as CVE-2025-61882 in the attacks. CrowdStrike and Mandiant later revealed that Clop exploited the flaws in early August to breach systems and deploy malware. While Clop would not share how many companies were impacted by the data theft attacks, Google's John Hultquist told BleepingComputer via email that they believe that dozens of organizations were affected. The Clop gang is also extorting Harvard University as part of this same data theft campaign, with the university confirming to BleepingComputer that the incident impacts a "limited number of parties associated with a small administrative unit." Last week, Oracle silently patched another E-Business Suite zero-day tracked CVE-2025-61884 without disclosing that it was actively exploited in July 2025. This zero-day is linked to an exploit leaked by the Shiny Lapsus$ Hunters extortion group on Telegram. American Airlines previously suffered data breaches in 2022 and 2023 that exposed employees' personal information. Who is Clop? The Clop ransomware operation, also tracked as TA505, Cl0p, and FIN11, launched in 2019 when it began breaching corporate networks to deploy a variant of the CryptoMix ransomware and steal data. Since 2020, the extortion gang shifted from primarily ransomware to exploiting zero-day vulnerabilities in secure file transfer or data storage platforms to steal data. Some of their attacks using zero-day flaws include: 2020: Exploiting a zero-day in the Accellion FTA platform, affecting nearly 100 organizations. 2021: Exploiting a zero-day in SolarWinds Serv-U FTP software. 2023: Exploiting a zero-day in the GoAnywhere MFT platform, breaching over 100 companies. 2023: Exploiting a zero-day in MOVEit Transfer was Clop's most extensive campaign to date, where a zero-day exploit allowed data theft from 2,773 organizations worldwide. 2024: Exploited two Cleo file transfer zero-days (CVE-2024-50623 and CVE-2024-55956) to steal data and extort companies. The U.S. State Department currently offers a $10 million reward for information linking Clop's ransomware activities to a foreign government. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Microsoft warns of a 32% surge in identity hacks, mainly driven by stolen passwords Hackers are increasingly using stolen identities to breach organizations, impersonating employees or contractors before stealing data and launching ransomware, according to new research. Microsoft’s 85-page Digital Defense Report 2025 covers dozens of pertinent cybersecurity issues including ransomware, nation-state attacks, AI and more. But the company’s researchers said the one statistic that stood out more than most others was the continued success of password attacks that allowed hackers to take over victim accounts. Despite a growing sophistication of cyber threats, “more than 97% of identity attacks are password attacks. In the first half of 2025 alone, identity based attacks surged by 32%,” said Amy Hogan-Burney, a corporate vice president at Microsoft. “That means the vast majority of malicious sign-in attempts an organization might receive are via large-scale password guessing attempts. Attackers get usernames and passwords (‘credentials’) for these bulk attacks by and large from credential leaks.” Hackers are also increasingly turning to other methods to obtain credentials. Microsoft tracked surges in the use of infostealer malware by criminals and an increase of IT scams where cybercriminals call a company’s help desk and simply ask for password resets. The scheme has drawn headlines in recent months due to a string of high-profile attacks launched by English-speaking cybercriminals connected to the Scattered Spider organization. Infostealers allow cybercriminals to quietly gather credentials and information at scale before either using it themselves or selling the data on cybercrime forums. Microsoft noted its role in taking down Lumma Stealer — one of the most prevalent infostealer observed in the last year. Microsoft said since the takedown, it has continued to “identify and dismantle new Lumma Stealer infrastructure.” Microsoft said it is still unclear whether the takedown will be effective but pointed to its work disrupting cracked versions of Cobalt Strike as evidence that these methods do have an impact. Microsoft’s report tracks trends from July 2024 through June 2025. The most targeted entities were IT companies and government bodies at the national and local level. In addition to identity-based attacks, Microsoft also said it saw several key vulnerabilities exploited — including CVE-2024-50623 which impacted popular file sharing tool Cleo and other bugs affecting prominent tools made by Fortinet, BeyondTrust and SimpleHelp. Image: Microsoft Ransomware affiliate shell games Microsoft incident responders said 19% of cases where they were able to determine a threat actor’s objectives involved ransomware. Microsoft cited figures from cybersecurity firm Intel 471 that found 120 ransomware variants were used against 71 industries over the last year, with more than half of all victims based in the U.S. Nearly half of all alleged victims seen on ransomware leak sites had an annual revenue of $50 million or less. Ransomware actors increasingly leveraged social engineering to obtain or reset credentials, particularly through vishing or tech support scams. “For example, this year multiple actors conducted help desk-themed social engineering, using messaging platforms such as Teams to communicate with targets and the Windows utility Quick Assist for remote access,” the company’s researchers said. Microsoft noted that it now tracks specific threat actors because many use multiple strains of ransomware. A cybercriminal known as Octo Tempest used Dragon Force, RansomHub and Qilin ransomware strains throughout the year, illustrating how simple it is for hackers to move between ransomware-as-a-service affiliation. In a separate notice on social media, Microsoft spotlighted a recent disruption of a threat actor that bounced between using Vice Society, Rhysida, BlackCat, Quantum Locker and Zeppelin ransomware strains. Another new trend spotted by Microsoft was the exploitation of antivirus (AV) exclusions to avoid detection. AV exclusions are typically used by IT or security teams to stop AV software from wasting resources scanning trusted files or directories, the researchers explained. “Attackers seek out misconfigurations such as overly broad exclusions, which they could use to disable or sidestep defenses during hands-on-keyboard intrusions,” Microsoft said. “This year, attackers used exclusions to bypass AV defenses in 30% of observed human-operated ransomware incidents. Despite these evolving threats, attacks reaching the encryption stage have slowed and are now increasing at a rate of only 7% in 2024-2025 compared to 102% in 2023-2024, per our incident tracking.” Jonathan Greig is a Breaking News Reporter at Recorded Future News. Jonathan has worked across the globe as a journalist since 2014. Before moving back to New York City, he worked for news outlets in South Africa, Jordan and Cambodia. He previously covered cybersecurity at ZDNet and TechRepublic.

Oracle has issued an emergency security update over the weekend to patch another E-Business Suite (EBS) vulnerability that can be exploited remotely by unauthenticated attackers. Tracked as CVE-2025-61884, this information disclosure flaw in the Runtime UI component affects EBS versions 12.2.3 to 12.2.14 and could allow unauthenticated threat actors to steal sensitive data remotely following successful exploitation. "This vulnerability is remotely exploitable without authentication, i.e., it may be exploited over a network without the need for a username and password. Oracle strongly recommends that customers apply the updates or mitigations provided by this Security Alert as soon as possible," Oracle said. "This vulnerability has received a CVSS Base Score of 7.5. If successfully exploited, this vulnerability may allow access to sensitive resources, added Rob Duhart, Oracle's Chief Security Officer. Oracle released the CVE-2025-61884 patch almost two weeks after a Clop extortion campaign targeting executives at multiple companies, which the company later linked to EBS vulnerabilities patched in July 2025 and then to another Oracle EBS vulnerability now tracked as CVE-2025-61882. Since then, cybersecurity firm CrowdStrike said they first spotted Clop exploiting CVE-2025-61882 as a zero-day since early August in data theft attacks and warned that other threat groups may have also joined the attacks. watchTowr Labs security researchers have also found that CVE-2025-61882 is leaked online by the Scattered Lapsus$ Hunters cybercrime gang. The Clop extortion group was behind other major data theft campaigns targeting zero-days in Accellion FTA, GoAnywhere MFT, Cleo, and MOVEit Transfer, with the latter impacting over 2,770 organizations. Oracle has not tagged the CVE-2025-61884 vulnerability patched over the weekend as exploited in the wild, and has yet to link it to CVE-2025-61882 attacks. However, seeing that internet-facing Oracle EBS instances are actively targeted, defenders are strongly advised to apply the out-of-band CVE-2025-61884 patch as soon as possible. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Oracle over the weekend announced the availability of a patch for another severe E-Business Suite (EBS) vulnerability that can be exploited to gain access to sensitive data. The newly patched flaw is tracked as CVE-2025-61884 and it has been assigned a ‘high severity’ rating. According to Oracle’s advisory, it impacts the Runtime UI component of Oracle Configurator and it can be exploited remotely without authentication and without requiring user interaction. The disclosure and patching of CVE-2025-61884 comes roughly two weeks after executives at dozens of organizations received extortion emails claiming that sensitive information had been stolen from their EBS instance. Oracle initially said the attacks exploited vulnerabilities patched in July 2025. It later admitted that a zero-day tracked as CVE-2025-61882 was also likely exploited. Over the weekend, Oracle informed customers about CVE-2025-61884, but has not said whether it has been exploited. It’s possible that CVE-2025-61884 was discovered during the investigation into CVE-2025-61882 and it may be exploited in similar attacks, but it hasn’t actually been used in the wild. “[CVE-2025-61884] affects some deployments of Oracle E-Business Suite,” said Rob Duhart, the CSO of Oracle. “If successfully exploited, this vulnerability may allow access to sensitive resources.” On the other hand, it’s still unclear exactly which CVEs and CVE combinations have been exploited in the recent attack. The attacks targeting Oracle EBS customers were claimed by the Cl0p group (likely due to its reputation), but Google Threat Intelligence Group (GTIG) and Mandiant have found multiple links to the FIN11 cybercrime group, which has been known to use the Cl0p ransomware in some of its attacks. However, GTIG and Mandiant have yet to confidently attribute the attack to a specific threat group. In addition to exploiting vulnerabilities, the threat actors used sophisticated malware to achieve their goals. The hackers are believed to have stolen significant amounts of data from some of the victims, which is not surprising. Previous large-scale campaigns linked to FIN11 and Cl0p resulted in the theft of sensitive information from Cleo, MOVEit, Fortra and Accellion file transfer products customers. Related: Cisco, Fortinet, Palo Alto Networks Devices Targeted in Coordinated Campaign Related: The Y2K38 Bug Is a Vulnerability, Not Just a Date Problem, Researchers Warn Related: All SonicWall Cloud Backup Users Had Firewall Configurations Stolen

Oracle links extortion campaign to bugs addressed in July patch Software giant Oracle confirmed reports that dozens of its customers have received extortion emails from cybercriminals demanding payment in exchange for not releasing troves of stolen information. In a statement published Thursday evening, Oracle chief security officer Rob Duhart said they are investigating claims made by the Clop ransomware gang that there was a breach of some Oracle E-Business Suite customers. “Our ongoing investigation has found the potential use of previously identified vulnerabilities that are addressed in the July 2025 Critical Patch Update,” Duhart said. “Oracle reaffirms its strong recommendation that customers apply the latest Critical Patch Updates.” The company did not explain which vulnerabilities in the July update were exploited and whether exploitation occurred after the update. Incident responders at Mandiant and Google Threat Intelligence Group (GTIG) released a warning about the incident on Wednesday evening, telling Recorded Future News in an email that they are tracking a campaign launched by a threat actor potentially linked to Clop — a gang that previously made a name for itself with high-profile data thefts involving file transfer tools. The latest campaign, according to the incident responders, involves data the hackers said was stolen through the Oracle E-Business Suite, a widely-used business platform containing several applications that manage finance, human resources and supply chain functions. Genevieve Stark, a senior cybercrime investigator at GTIG, said the team believes the campaign started on September 29 but is still in the early stages of multiple investigations. The extortion emails threaten to either publish victim company data or sell it on the dark web. The Cybersecurity and Infrastructure Security Agency (CISA) would not say whether it is assisting potential victims in response to the extortion emails, instead directing Recorded Future News to a 2023 advisory about Clop. Cynthia Kaiser, former Deputy Director of the FBI’s Cyber Division who now works for incident response firm Halcyon, said the first observed email contact from Clop began in late September. “We have seen seven and eight figure demands thus far,” Kaiser said of Clop’s ransom demands. Kaiser explained that the threat actors shared screenshots and filetree listings to prove they had accessed data, noting that the tactics used aligned with previous Clop campaigns. After emerging in 2019, Clop targeted vulnerabilities in internet-facing file sharing software from Cleo, MOVEit, GoAnywhere and Accellion. Jonathan Greig is a Breaking News Reporter at Recorded Future News. Jonathan has worked across the globe as a journalist since 2014. Before moving back to New York City, he worked for news outlets in South Africa, Jordan and Cambodia. He previously covered cybersecurity at ZDNet and TechRepublic.

Oracle has confirmed that some of its customers have received extortion emails and the software giant’s investigation indicates that the attackers may have exploited known vulnerabilities. Google Threat Intelligence Group (GTIG) and Mandiant revealed this week that executives at many organizations using Oracle’s E-Business Suite (EBS) enterprise resource planning product have received emails claiming the theft of sensitive information. GTIG and Mandiant researchers have yet to confirm the hackers’ claims, but pointed out that the extortion emails claim to come from members of the notorious Cl0p cybercrime group, and the messages have been sent from compromised accounts previously linked to another cybercrime gang tracked as FIN11. Contacted by SecurityWeek, Oracle representatives pointed to a blog post published on Thursday by Rob Duhart, the software giant’s chief security officer. Duhart said the company is aware that some E-Business Suite customers have received extortion emails. “Our ongoing investigation has found the potential use of previously identified vulnerabilities that are addressed in the July 2025 Critical Patch Update,” Duhart explained, without naming the potentially exploited flaws. Oracle fixed roughly 200 vulnerabilities with its July 2025 CPU. Nine patches were released for E-Business Suite, including three for flaws that can be exploited remotely without authentication. These three vulnerabilities, all rated ‘medium severity’, are tracked as CVE-2025-30746, CVE-2025-30745 and CVE-2025-50107. Oracle’s advisory indicates that user interaction is required for their exploitation. Three vulnerabilities fixed in July in E-Business Suite have been assigned a ‘high severity’ rating: CVE-2025-30743, CVE-2025-30744, and CVE-2025-50105. While they do not allow remote exploitation without authentication, their exploitation does not require user interaction. If the involvement of Cl0p and/or FIN11 is confirmed, it should not come as a surprise. Both groups, which are linked, are known to launch campaigns that involve the exploitation of vulnerabilities in software that is used by many organizations to handle sensitive data. Cl0p was behind campaigns targeting Cleo, MOVEit, and Fortra file transfer products. The FIN11 group was behind a campaign that targeted an Accellion file transfer service. All of these campaigns involved the exploitation of zero-day flaws. Earlier this year, Oracle confirmed that hackers managed to steal data from a legacy cloud environment. Related: CISA Issues Guidance After Oracle Cloud Hack Related: Recent Fortra GoAnywhere MFT Vulnerability Exploited as Zero-Day

A significant number of organizations have received extortion emails from hackers who claim to have stolen sensitive information from their Oracle E-Business Suite instances, Google’s Threat Intelligence Group and Mandiant unit warn. Oracle E-Business Suite (EBS) is a suite of integrated business applications used by large organizations to automate and manage business processes. Oracle says thousands of organizations around the world use this enterprise resource planning (ERP) system. According to Google Threat Intelligence Group (GTIG) and Mandiant, the malicious activity allegedly targeting Oracle EBS appears to have started on or around September 29. The attackers have sent extortion emails to executives at “numerous” companies, claiming to be affiliated with the notorious Cl0p cybercrime group. GTIG and Mandiant researchers have described the attacks as a high-volume email campaign leveraging hundreds of compromised accounts, including ones previously linked to a profit-driven threat group named FIN11. This long-running cybercrime gang is known to engage in ransomware deployment and extortion. The researchers also found some evidence indicating a connection to Cl0p. Specifically, the contact information provided by the attackers in the emails sent to targeted organizations matches contact addresses listed on the Cl0p leak website. Mandiant and GTIG said they are in the early stages of their investigations and could not confirm whether the hackers’ claims are substantiated. “It is critical to note that while the tactics align with an extortion motive and the actor is explicitly claiming this connection, GTIG does not currently have sufficient evidence to definitively assess the veracity of these claims,” said Charles Carmakal, CTO of Mandiant. Carmakal added, “Attribution in the financially motivated cybercrime space is often complex, and actors frequently mimic established groups like Clop to increase leverage and pressure on victims.” If Cl0p or FIN11 hackers are confirmed to be behind the attacks, it would not come as a surprise. Both groups are known to launch campaigns that target many organizations through vulnerable software, often via the exploitation of zero-day flaws. Cl0p last year claimed to have stolen data from dozens of organizations after exploiting a zero-day vulnerability in Cleo file transfer tools. The group previously managed to steal the information of tens of millions of users from thousands of organizations through the exploitation of a zero-day in MOVEit Transfer file transfer software. In addition, Cl0p was blamed for a 2023 attack that involved a Fortra GoAnywhere managed file transfer product zero-day and which hit dozens of organizations. A few years ago, the FIN11 group was behind a similar campaign that involved the theft of sensitive data from dozens of organizations that had been using an Accellion file transfer service. That campaign also involved the exploitation of a zero-day vulnerability. In some campaigns analyzed in the past, researchers had found links between Cl0p and FIN11. SecurityWeek has reached out to Oracle for comment and will update this article if the company responds. Related: Infostealers: The Silent Smash-and-Grab Driving Modern Cybercrime Related: Recent Fortra GoAnywhere MFT Vulnerability Exploited as Zero-Day

Mandiant and Google are tracking a new extortion campaign where executives at multiple companies received emails claiming that sensitive data was stolen from their Oracle E-Business Suite systems. According to Genevieve Stark, Head of Cybercrime and Information Operations Intelligence Analysis at GTIG, the campaign began in late September. "This activity began on or before September 29, 2025, but Mandiant's experts are still in the early stages of multiple investigations, and have not yet substantiated the claims made by this group," Stark said. Charles Carmakal, CTO of Mandiant – Google Cloud, stated that the extortion emails are being sent from a large number of compromised email accounts. "We are currently observing a high-volume email campaign being launched from hundreds of compromised accounts and our initial analysis confirms that at least one of these accounts has been previously associated with activity from FIN11, a long-running financially motivated threat group known for deploying ransomware and engaging in extortion," Carmakal explained. In an example of the extortion email shared with BleepingComputer, Clop says they breached the company's Oracle E-Business Suite in a data theft attack. "We are CL0P team. If you haven't heard about us, you can google about us on internet," reads the extortion email shared with BleepingComputer. "We have recently breached your Oracle E-Business Suite application and copied a lot of documents. All the private files and other information are now held on our systems." "But, don't worry. You can always save your data for payment. We do not seek political power or care about any business. So, your only option to protect your business reputation is to discuss conditions and pay claimed sum." "In case you refuse, you will lose all abovementioned data: some of it will be sold to the black actors, the rest will be published on our blog and shared on torrent trackers." Mandiant and GTIG report, and BleepingComputer has confirmed, that the email addresses listed in the extortion email are the same as those on the Clop ransomware gang's data leak site, indicating a possible link to the extortion group. However, Carmakal says that while the tactics are similar to Clop's previous extortion campaigns and the email addresses indicate a potential link, there is not enough evidence to determine if data has actually been stolen. Mandiant and GTIG recommend that organizations receiving these emails investigate their environments for unusual access or compromise in their Oracle E-Business Suite platforms. After publishing this story, Clop claimed to BleepingComputer that they are involved in the extortion email, indicating a bug in Oracle's product was exploited in the attacks. However, the threat actors would not share more detailed information about the alleged attacks. "We not prepared to discuss details at this time," Clop told BleepingComputer. "Soon all will become obvious that Oracle bugged up their core product and once again, the task is on clop to save the day. We do not damage to systems and only expect payment for services we provide to protect hundreds of biggest companies in world." Oracle also published a brief post today by Rob Duhart, Chief Security Officer, Oracle Security, who said that they believe the threat actors exploited vulnerabilities patched in the July 2025 security updates. "Our ongoing investigation has found the potential use of previously identified vulnerabilities that are addressed in the July 2025 Critical Patch Update," explained Duhart. "Oracle reaffirms its strong recommendation that customers apply the latest Critical Patch Updates." If you have any information regarding this incident or any other undisclosed attacks, you can contact us confidentially via Signal at 646-961-3731 or at [email protected]. Who is the Clop extortion gang? The Clop ransomware operation, also tracked as TA505, Cl0p, and FIN11, launched in March 2019 when it began targeting enterprise networks with a variant of the CryptoMix ransomware. Like other ransomware gangs, Clop members breach corporate networks, steal data, and then deploy ransomware to encrypt systems. The stolen data and encrypted files are then used as leverage to force companies to pay a ransom demand in exchange for a decryptor and to prevent the leaking of the stolen data. While the group is still known to deploy ransomware, since 2020, they have shifted to exploiting zero-day vulnerabilities in secure file transfer platforms to steal data. Some of their most notable attacks include: 2020: Exploiting a zero-day in the Accellion FTA platform, affecting nearly 100 organizations. 2021: Exploiting a zero-day in SolarWinds Serv-U FTP software. 2023: Exploiting a zero-day in the GoAnywhere MFT platform, breaching over 100 companies. 2023: Exploiting a zero-day in MOVEit Transfer was Clop's most extensive campaign to date, where a zero-day exploit allowed data theft from 2,773 organizations worldwide. The most recent campaign associated with Clop was in October 2024, when the threat actors exploited two Cleo file transfer zero-days (CVE-2024-50623 and CVE-2024-55956) to steal data and extort companies. The U.S. State Department currently offers a $10 million reward through its Rewards for Justice program for information linking Clop's ransomware activities to a foreign government. Update 10/2/25: Added sample of Clop extortion email being sent to companies. Update 10/2/25 07:42 PM ET: Added statement from the Clop ransomware gang and further info from Oracle. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report