moveit

The Cl0p ransomware group has named more than 40 organizations allegedly targeted in the recent campaign that exploited a vulnerability in PTC’s product lifecycle management (PLM) platforms Windchill and FlexPLM. The vulnerability and its exploitation The exploitation of the vulnerability, tracked as CVE-2026-12569, came to light in June, when CISA added it to its KEV catalog and the vendor warned of attacks targeting it. The flaw is an improper input validation issue that allows a remote, unauthenticated attacker to achieve arbitrary code execution via specially crafted requests. Exploitation of the vulnerability was expected, with police in Germany reportedly alerting organizations about imminent attacks. It’s worth noting that CVE-2026-12569 is the first ever Windchill vulnerability to be exploited in the wild. The cybersecurity industry reported seeing exploitation of the PLM product flaw in Cl0p ransomware attacks in late July. Cl0p affiliates exploited the security hole to deliver web shells that gave them access to the data of organizations using Windchill. Security firm ReliaQuest reported on Tuesday that Cl0p has been using a custom implant designed to provide “full data theft capability” without requiring additional tools. “[The web shell] maps sensitive vault data, decrypts every credential in the Windchill keystore, and includes a custom Java class loader that lets Clop execute any additional code inside the application process, extending the shell into an unlimited backdoor for follow-on activity such as lateral movement, ransomware, or persistence,” ReliaQuest explained. Cl0p attacks The Cl0p cybercrime gang initially only listed partial company names on its website, but on August 12 it started releasing alleged victims’ full names. More than 40 organizations apparently targeted in the Windchill campaign have been named to date. For each victim, the hackers listed the type and amount of information they have stolen. The type of exfiltrated data includes databases, project files, backups, photographs and other image files, engineering documents, blueprints, diagrams, logs, and other corporate documents. The amount of stolen information per organization ranges between 1 GB and several terabytes, according to the hackers. The compromised files could contain sensitive personal information and valuable intellectual property, but much of it may be of little value and already in the public domain, which is why many of the targeted organizations have likely refused to pay a ransom. The list of alleged victims includes oil and gas giant Shell, tech giant Philips, fintech giant Fiserv, enterprise mobility provider Zebra Technologies, industrial equipment manufacturer Ingersoll Rand, point-of-sale software maker Toast, global medical technology leader Mindray, and key Apple camera lens supplier Largan Precision. GE was initially listed as well, but it has since been removed from the Cl0p website, which could indicate that the company has agreed to pay a ransom or has resumed negotiations with the hackers. Companies such as Shell, Philips, Fiserv and GE stated that they are aware of the claims and are investigating, but none has confirmed a significant data breach. Cl0p previously conducted similar data theft and extortion campaigns targeting vulnerabilities in Oracle E-Business Suite, MOVEit, Cleo, and GoAnywhere software. Related: CareCloud Data Breach Impact Grows to 3.7 Million Individuals Related: Heights Finance Data Breach Impacts at Least 1.2 Million Individuals Related: 680,000 Impacted by French Tax Authority Data Breach

A JavaServer Pages (JSP) web shell deployed following the exploitation of a critical security flaw in PTC Windchill and FlexPLM servers is specifically designed for the enterprise Product Lifecycle Management (PLM) software, according to new findings from ReliaQuest. The cybersecurity company characterized the web shell as a fully equipped extortion platform capable of mapping sensitive vault data, decrypting every credential in the Windchill keystore, and running additional code by means of a custom Java class loader, turning the tool into a backdoor for remote access and post-exploitation activity, such as lateral movement, ransomware, or persistence. While threat actors are typically known to deploy lightweight web shells (or reuse open-source variants like Behinder or China Chopper) as a way to maintain remote access to compromised systems and enable basic command execution capabilities, the latest development signals the use of a bespoke web shell that's tailored to the software being exploited. The web shell is deployed following the weaponization of CVE-2026-12569 (CVSS score: 9.3), which relates to a case of improper input validation that could allow an attacker to execute arbitrary code by sending a malicious request to the network. An advisory released by Ransom-ISAC along with eCrime.ch and Defused last month attributed the malicious activity to the Clop (aka Cl0p) ransomware operation, with the threat actor dropping JSP web shells against susceptible systems. "The web shell gives attackers a direct path to credential theft and large-scale data exfiltration, with no additional tooling required," ReliaQuest said in a report shared with The Hacker News. "Unlike generic command shells, this implant decrypts credentials, delivers malware, and maps stored files for exfiltration." The web shell is assessed to be an application-specific evolution of Cl0p's tried-and-tested mass-exploitation playbook, purpose-built to single out vulnerable PTC Windchill and FlexPLM instances. "It embeds detailed knowledge of the application's APIs, database schema, keystore, and file-vault structure, enabling rapid movement from access to data theft, without external commands or additional tools," researchers John Dilgen and Connor Short said. "References to 'Clop' throughout reflect this highly likely attribution." Because the targeted applications are used to store engineering data and product designs, a successful compromise can allow the attackers to obtain proprietary data from victims, as well as sensitive credentials that could be abused to laterally move into the network and reach other systems. One of the notable features of the web shell is a single "S" command that returns Windchill's directory-management and administrative credentials in plaintext by making use of a built-in function called gs that performs the following steps - Reads Windchill's "ieStructProperties.txt" configuration file Decrypts the Lightweight Directory Access Protocol (LDAP) manager password from the application keystore Iterates through all stored local properties, decrypting additional encrypted values including administrative account credentials, object storage credentials, and all site administrator keys In the case of active compromise, the "S" command can also be used to extract the credentials used to manage the organization's LDAP directory. A separate command is then used to exfiltrate the results. "Because LDAP credentials typically govern access to Active Directory, email systems, VPN, and other enterprise services tied to directory authentication, their exposure could turn a single application compromise into an enterprise-wide credential compromise," ReliaQuest said. "The resulting privileged access fuels data theft from additional applications and storage locations, as well as persistence for follow-on attacks." ReliaQuest told The Hacker News that the web shell supports the following commands - S — Returns Windchill credentials in plaintext E — Returns the parameter value directly, likely used to test connectivity O — Returns the operating system name J — Loads and executes a Java class from a ZIP via the class loader D — Runs the file download function S — Runs the credential harvesting function L — Runs the file vault enumeration and writes "flst.txt" G — Reads an arbitrary file from the file system R — Deletes a file; used for cleanup What's more, the ability of the web shell to run attacker-supplied code in memory offers a pathway for deploying secondary payloads on demand, including tools for long-term persistence, network traversal, or data encryption. The payload takes the form of a Base64-encoded ZIP file containing compiled Java bytecode that's loaded directly into memory and executed. Some of the functions baked into the web shell are as follows - A vault enumeration capability that targets the application database to identify high-value engineering data without executing manual discovery commands Executing queries through Windchill's existing database identity rather than creating a new attacker-controlled account to reduce forensic visibility Taken together, the web shell functions more akin to an implant that conducts Windchill-specific discovery and credential access from inside the application process, while using the application's own database connections and blending in with regular Windchill traffic to evade traditional signature-based defenses. "The combination of a feature-rich implant that requires no additional tooling to begin stealing data, paired with an extensible delivery mechanism for follow-on capability, gives the adversary a complete toolkit from the moment of access," ReliaQuest said. "The attacker can therefore move quickly from initial access through data theft to further post-exploitation activity entirely within the application's own trust boundary, using the web shell's purpose-built features without executing manual commands. The approach significantly limits defenders' ability to detect the activity, as it closely mimics the application's standard functions." This is not the first time the Clop gang has deployed custom web shells. The e-crime group was previously observed dropping DEWMODE and LEMURLOOT after exploiting SQL injection flaws in Accellion (CVE-2021-27101) and MOVEit Transfer (CVE-2023-34362) file transfer software, respectively. "This campaign is another reminder that Clop remains a sleeping dragon, always looking and preparing to mass exploit vulnerabilities in software that holds sensitive data," ReliaQuest said. "The group commonly goes inactive between campaigns but springs to life with custom-built web shells whenever there is another opportunity for mass extortion."

A custom Java web shell likely linked to the Clop ransomware gang was designed specifically for PTC Windchill and FlexPLM servers, with built-in features to decrypt credentials, enumerate file repositories, and steal files. Cybersecurity company ReliaQuest analyzed the web shell after it is believed to have been deployed in recent data theft attacks exploiting CVE-2026-12569, a critical remote code execution vulnerability affecting PTC Windchill. ReliaQuest says the implant is not a generic web shell repurposed for the attacks, but was instead built with detailed knowledge of Windchill's internal APIs, database schema, keystore, and file-vault structure. "This appears to be an application-specific evolution of Clop's established mass-exploitation playbook," ReliaQuest said in a report shared with BleepingComputer. The researchers say they found the web shell during the intelligence collection process. The researchers say the activity is likely linked to Clop based on extortion emails containing addresses used on the ransomware gang's data leak site, previously observed X-windchill-req headers also used in the web shell, and TTps commonly used by the threat actors. The Clop extortion gang has a long history of breaching enterprise platforms in data theft attacks, with previous campaigns targeting Accellion FTA, GoAnywhere MFT, SolarWinds Serv-U FTP, Cleo, and MOVEit Transfer file-sharing servers, the latter affecting more than 2,770 organizations worldwide. As BleepingComputer reported in July, Clop targeted exposed PTC Windchill and FlexPLM servers in a data theft extortion campaign involving exploitation of CVE-2026-12569 and the deployment of JSP web shells. At the time, ReliaQuest said attribution was unconfirmed, but the attacks shared similarities with previous Clop data-theft campaigns targeting secure file-sharing applications. Ransom-ISAC later confirmed Clop activity associated with the attacks, including extortion emails sent to hundreds of employees at affected organizations and containing the gang's latest contact information. PTC began releasing fixes for CVE-2026-12569 on June 17, and CISA later added the vulnerability to its Known Exploited Vulnerabilities catalog following warnings of heightened threat activity. A web shell built specifically for Windchill Analysis by ReliaQuest and BleepingComputer confirms the tool was designed to target Windchill servers rather than act as a generic web shell. The malware is a JavaServer Pages (JSP) web shell that directly imports Windchill-specific classes, including MethodContext, WTConnection, and WTKeyStoreUtil. These classes allow the shell to use Windchill's own functions to access its database, decrypt stored credentials, and locate files stored in application vaults. "The web shell connects to Windchill's database through the application's own MethodContext and WTConnection classes, meaning its queries run under the application's existing database identity rather than through a separately configured attacker account," explains ReliaQuest. "As a result, database telemetry may attribute this activity to the application's normal service identity, limiting the value of alerts that rely solely on detecting new accounts or unexpected source hosts." The web shell is controlled using a custom protocol sent through the HTTP X-windchill-req header, which contains eight characters, with the first character specifying the command and the remaining seven matching a fixed value. The web shell supports the following commands: S – Steal Windchill secrets and configuration: Reads Windchill's LDAP configuration and uses the application's ownWTKeyStoreUtil.decryptProperty() function to decrypt the LDAP manager password and other encrypted application data. L – Map Windchill's file vault: Searches Windchill's database for filenames, storage paths, and file sizes. The results are written to a file namedflst.txt , which can then be retrieved by the attackers usingG command. D – Enumerate directories and retrieve files: Enumerates supplied paths and reads portions of files. G – Read a file: Retrieves the contents of a specified file. R – Delete a file: Deletes a specified file. J – Load and execute additional Java code: Passes a Base64-encoded ZIP archive and loads compiled Java bytecode directly into memory and executes it within the Windchill process. O – Identify the operating system: Returns the operating system name. E – Echo supplied data: Echoes data in theX-windchill-prm header to verify the webshell is responding. ReliaQuest says the web shell's vault enumeration is also designed specifically to query certain tables in Windchill's database. BleepingComputer's analysis shows that these tables are ApplicationData, FVITEM, FVMOUNT, and MasteredOnReplicaItem. The cybersecurity company recommends that organizations immediately patch vulnerable Windchill systems and look for unusual JSP files in Windchill directories, especially those containing reference to X-windchill-req. Organizations that suspect their Windchill servers were compromised should also change the LDAP manager password and other Windchill credentials, as they should be considered compromised. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Tech giants General Electric (GE) and Philips have also confirmed they're investigating claims that the Clop ransomware gang breached their systems and stole data. While a GE spokesperson said the company is aware of the claim and is "working to assess the potential issue," a Philips spokesperson confirmed its systems were breached but said the incident has been contained and didn't affect customers. "Philips has identified and contained an attempted cybersecurity compromise of a specific enterprise server related to internal data," Philips said in a statement shared with Reuters. "This has no impact on customer environments." GE and Philips spokespersons have yet to reply after BleepingComputer also reached out to them for more details and to confirm the Clop ransomware gang's claims. This comes after oil giant Shell also said on Friday that it is investigating a potential security incident after the Clop hacking group claimed it stole 89GB of data. "We are aware of a potential incident," a Shell spokesperson told BleepingComputer when asked to confirm the gang's data theft claims. "We are working with our security teams and relevant experts to investigate. While the three companies have yet to share more information, the Clop gang has listed them on its leak site as part of a batch of 43 new victims likely targeted in data theft attacks exploiting a critical improper input validation vulnerability (tracked as CVE-2026-12569) against Internet-exposed PTC Windchill and PTC FlexPLM instances. PTC says the two enterprise software platforms are widely used by high-profile companies across the aerospace, defense, automotive, heavy machinery, retail, and medtech sectors. The company says more than 30,000 customers globally use its products, including over 1,500 brand and retail customers using FlexPLM. In these attacks, Clop claims it stole a wide range of sensitive data from the companies' compromised systems, including backups, project plans, photos of facilities, drawings, diagrams, blueprints, and more, belonging to Shell, GE, and Philips. PTC began releasing CVE-2026-12569 security patches on June 17 and urged customers to review environments for indicators of compromise (IOCs) in a private advisory, even though there was no confirmation of in-the-wild exploitation. Since then, cybersecurity company ReliaQuest and the Ransomware Information Sharing and Analysis Centre (Ransom-ISAC) have confirmed Clop's Windchill and FlexPLM attacks, in which the threat actors have been deploying JSP webshells to steal sensitive data from victims' compromised PLM platforms. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) also confirmed that the flaw is actively exploited in attacks after PTC warned of "heightened threat activity" on June 26, mandating federal agencies to secure their PTC Windchill and FlexPLM instances within three days after adding it to its catalog of known exploited vulnerabilities. This vulnerability has also prompted emergency action from German authorities, with the Federal Office for Information Security (BSI) warning PTC customers in the middle of the night to patch systems as quickly as possible. The Clop extortion gang has a long history of targeting enterprise platforms in data theft attacks, breaching Accellion FTA, GoAnywhere MFT, SolarWinds Serv-U FTP, Cleo, and MOVEit Transfer file-sharing servers in previous campaigns, with the latter affecting over 2,770 organizations worldwide. Starting in early August 2025, it also began exploiting an Oracle EBS zero-day flaw to steal sensitive files from many organizations. The list of victims includes many high-profile organizations worldwide, including The Washington Post, GlobalLogic, Harvard University, the University of Pennsylvania, Logitech, Estée Lauder, Korean Air, and American Airlines subsidiary Envoy Air. The U.S. Department of State now offers a $10 million reward for any information linking the cybercrime gang's attacks to a foreign government. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Progress Software: aggiornamenti di sicurezza Alert AL06/260724/CSIRT-ITA Sintesi Progress Software ha rilasciato aggiornamenti di sicurezza per risolvere quattro vulnerabilità con gravità “alta”, nel prodotto MOVEit Transfer, noto software aziendale utilizzato per scambiare file sensibili in modo sicuro, centralizzato e controllato. Tipologia Authentication Bypass Security Restrictions Bypass Information Disclosure Prodotti e/o versioni affette MOVEit Transfer, versioni precedenti alla 2026.0.3 Azioni di mitigazione In linea con le dichiarazioni del vendor, si raccomanda di aggiornare i prodotti vulnerabili seguendo le indicazioni del bollettino di sicurezza disponibile nella sezione Riferimenti.

Progress heeft kwetsbaarheden verholpen in MOVEit Transfer, specifiek in de Custom Reports modules en de Ad Hoc module. De kwetsbaarheden betreffen meerdere versies van MOVEit Transfer, waaronder 25.0.0 tot en met 25.0.7, 25.1.0 tot en met 25.1.3, en 26.0.0 tot net voor 26.0.1. Eén kwetsbaarheid in de Custom Reports modules betreft een onjuiste neutralisatie van speciale elementen binnen data query logica, waardoor queryparameters gemanipuleerd kunnen worden wat kan leiden tot ongeautoriseerde data toegang of corruptie. Daarnaast is er een geheugenrelease-kwetsbaarheid in dezelfde modules die te maken heeft met de levensduur van geheugen, wat kan resulteren in onjuiste geheugenbeheer. Verder is er een cross-site scripting (XSS) kwetsbaarheid in de Ad Hoc module, veroorzaakt door onjuiste inputneutralisatie, waardoor kwaadaardige scripts kunnen worden geïnjecteerd en uitgevoerd binnen de context van de applicatie.

Progress heeft kwetsbaarheden verholpen in MOVEit Automation. De kwetsbaarheid met kenmerk CVE-2026-4670 betreft een bypass van de authenticatie in MOVEit Automation. Een kwaadwillende zonder rechten kan deze kwetsbaarheid misbruiken zonder dat daar gebruikersinteractie voor nodig is. De tweede kwetsbaarheid met kenmerk CVE-2026-5174 betreft een onjuiste invoervalidatie in Progress Software MOVEit Automation en maakt privilege-escalatie mogelijk. Deze kwetsbaarheden zijn aanwezig in versies 2025.0.0 tot maar niet inclusief 2025.0.9, versies 2024.0.0 tot maar niet inclusief 2024.1.8, en alle versies vóór 2024.0.0.

Progress Software has released updates to address two security flaws in MOVEit Automation, including a critical bug that could result in an authentication bypass. MOVEit Automation (formerly Central) is a secure, server-based managed file transfer (MFT) solution used to schedule and automate file movement workflows in enterprise environments without requiring any custom scripts. The vulnerabilities in question are CVE-2026-4670 (CVSS score: 9.8), an authentication bypass vulnerability, and CVE-2026-5174 (CVSS score: 7.7), an improper input validation vulnerability that could allow privilege escalation. "Critical and high vulnerabilities in MOVEit Automation may allow authentication bypass and privilege escalation through the service backend command port interfaces," Progress Software said in an advisory. "Exploitation may lead to unauthorized access, administrative control, and data exposure." The shortcomings affect the following versions - MOVEit Automation <= 2025.1.4 (Fixed in MOVEit Automation 2025.1.5) MOVEit Automation <= 2025.0.8 (Fixed in MOVEit Automation 2025.0.9) MOVEit Automation <= 2024.1.7 (Fixed in MOVEit Automation 2024.1.8) Airbus SecLab researchers Anaïs Gantet, Delphine Gourdou, Quentin Liddell, and Matteo Ricordeau have been credited with discovering and reporting the two vulnerabilities. There are no workarounds that resolve the issues. While Progress makes no mention of the flaws being exploited in the wild, it's essential that users apply the fixes as soon as possible for optimal protection, particularly given that prior flaws in MOVEit Transfer have been exploited by ransomware gangs like Cl0p.

Progress Software warned customers to patch a critical authentication bypass vulnerability in its MOVEit Automation enterprise-grade managed file transfer (MFT) application. MOVEit Automation automates complex data workflows without requiring manual scripting and serves as a central automation orchestrator to schedule and manage file transfers between different systems, including local servers, cloud storage, and external partners. Tracked as CVE-2026-4670, the security flaw affects MOVEit Automation versions before 2025.1.5, 2025.0.9, and 2024.1.8. Remote threat actors can exploit it without privileges on the targeted systems in low-complexity attacks that don't require user interaction. "We have addressed the vulnerability and the Progress MOVEit Automation team strongly recommends performing an upgrade to the latest version," the company says in a Thursday advisory. "Upgrading to a patched release, using the full installer, is the only way to remediate this issue. There will be an outage to the system while the upgrade is running." The same day, Progress also released security updates to address a high-severity privilege escalation vulnerability (CVE-2026-5174) stemming from an improper input validation weakness in the same software. According to a Shodan search shared by PwnDefend cybersecurity consultant Daniel Card, over 1,400 MOVEit Automation instances are exposed online, and over a dozen are linked to U.S. local and state government agencies. However, there is no information regarding how many of these systems have already been secured against CVE-2026-4670 attacks. While the company has yet to flag these security issues as exploited in the wild, other MoveIT MFT vulnerabilities have been targeted in attacks in recent years. For instance, the Clop ransomware gang exploited a zero-day in the MOVEit Transfer secure file transfer platform in an extensive series of data theft attacks in 2023 that affected more than 2,100 organizations and over 62 million individuals, according to Emsisoft estimates. MFT software is an attractive target for ransomware actors, as seen in previous Clop data-theft campaigns targeting security flaws in Accellion FTA, SolarWinds Serv-U, Gladinet CentreStack, GoAnywhere MFT, and Cleo. Progress Software says its MOVEit MFT solutions are used by more than 3,000 enterprise organizations and over 100,000 users worldwide. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Rilevate vulnerabilità in Progress MOVEit Automation Alert AL01/260504/CSIRT-ITA Sintesi Rilevate due vulnerabilità, di cui una con gravità “critica”, nel prodotto Progress Software MOVEit Automation. Tali vulnerabilità, qualora sfruttate, potrebbero consentire ad un utente malintenzionato di aggirare i meccanismi di autenticazione e di ottenere privilegi elevati, con conseguente accesso non autorizzato alle funzionalità del sistema. Tipologia Authentication Bypass Privilege Escalation Prodotti e/o versioni affette Progress MOVEit Automation 2025.1.x, versioni precedenti alla 2025.1.5 2025.0.x, versioni precedenti alla 2025.0.9 2024.0.x, versioni precedenti alla 2024.1.8 tutte le versioni precedenti alla 2024.0.0 Azioni di mitigazione In linea con le dichiarazioni del vendor, si raccomanda di aggiornare i prodotti vulnerabili seguendo le indicazioni del bollettino di sicurezza riportato nella sezione Riferimenti.

Progress Software: aggiornamenti di sicurezza Alert AL02/260421/CSIRT-ITA Sintesi Progress Software ha rilasciato aggiornamenti di sicurezza per risolvere diverse vulnerabilità con gravità “alta”, nei prodotti LoadMaster, ECS Connection Manager, Connection Manager e MOVEit WAF. Tipologia Remote Code Execution Prodotti e/o versioni affette LoadMaster versione GA v7.2.62.2 e precedenti versione LTSF v7.2.54.16 e precedenti ECS Connection Manager versione v7.2.62.2 e precedenti Connection Manager for ObjectScale versione v7.2.62.2 e precedenti MOVEit WAF versione GA v7.2.62.2 e precedenti Azioni di mitigazione In linea con le dichiarazioni del vendor, si consiglia di aggiornare i prodotti vulnerabili seguendo le indicazioni dei bollettini di sicurezza disponibili ai link nella sezione Riferimenti. https://community.progress.com/s/article/LoadMaster-Security-Vulnerabilites-CVE-2026-3517-CVE-2026-3518-CVE-2026-3519-CVE-2026-4048-CVE-2026-21876 https://community.progress.com/s/article/MOVEit-WAF-Critical-Security-Bulletin-April-2026-CVE-2026-3517-CVE-2026-3518-CVE-2026-3519-CVE-2026-4048-CVE-2026-21876

Progress Software on Monday rolled out patches for multiple MOVEit WAF and LoadMaster vulnerabilities that could lead to remote code execution (RCE) and OS command injection. Two of the bugs, CVE-2026-3517 and CVE-2026-3519, impact APIs in Progress ADC products and could be exploited by users with ‘Geo Administration’ and ‘VS Administration’ permissions for the execution of arbitrary commands on the LoadMaster appliance. The flaws exist because the ‘addcountry’ and ‘aclcontrol’ commands do not properly sanitize user-supplied input. Another issue, tracked as CVE-2026-3518, impacts an API in the ADC products’ LoadMaster and can be exploited by an authenticated attacker who has the ‘All’ permissions. It exists because the ‘killsession’ command allows unsanitized input. The fourth security defect, CVE-2026-4048, impacts the UI in Progress ADC products. An authenticated attacker with the ‘All’ permissions can inject code in a custom WAF rule file, leading to command execution as the input is improperly sanitized during the file upload process. On Monday, Progress also announced fixes for CVE-2026-21876, a firewall policy bypass issue in the rule set to flag non-standard character sets used in HTTP multipart request headers. The flawed logic leads to character set validation being applied only to the last multipart content type header, even if the application iterates over all headers in the request. “This vulnerability allows a specially crafted multipart request to contain an encoded malicious payload that will bypass WAF detection,” Progress explains. Successful exploitation of these flaws could allow authenticated attackers to execute arbitrary commands and code on the LoadMaster and MOVEit WAF appliances. Progress patched the bugs in MOVEit WAF version 7.2.63.0, LoadMaster GA version 7.2.63.1, LoadMaster LTSF version 7.2.54.17, ECS Connection Manager version 7.2.63.1, and Connection Manager for ObjectScale version 7.2.63.1. The company says it has not received any reports that these vulnerabilities have been exploited, but urges customers to update their deployments as soon as possible. Related: Organizations Warned of Exploited Cisco, Kentico, Zimbra Vulnerabilities Related: Splunk Enterprise Update Patches Code Execution Vulnerability Related: Cisco Patches Critical Vulnerabilities in Webex, ISE Related: Two Vulnerabilities Patched in Ivanti Neurons for ITSM

Vulnerabilità in MOVEit WAF Alert AL06/260114/CSIRT-ITA Sintesi Rilevate due vulnerabilità di sicurezza con gravità “alta” nel software MOVEit WAF di Progress. Tali vulnerabilità, qualora sfruttate, potrebbero consentire a un utente malintenzionato remoto di eseguire codice arbitrario sui sistemi interessati. Tipologia Remote Code Execution Prodotti e versioni affette Progress MOVEit WAF, versione 7.2.62.1 Azioni di mitigazione In linea con le dichiarazioni del vendor, si raccomanda di aggiornare i prodotti vulnerabili seguendo le indicazioni del bollettino di sicurezza riportato nella sezione Riferimenti.

Harvard University over the weekend disclosed a data breach impacting the personal information of alumni, donors, students, parents, staff, and other individuals. The incident was discovered on November 18 and involved unauthorized access to systems used by its Alumni Affairs and Development department, the higher-education institution said in a Saturday notice. Harvard said that it immediately blocked the attacker’s access to the impacted systems and that it launched an investigation in collaboration with third-party cybersecurity experts and law enforcement. “We are continuing to closely monitor and have no evidence of further unauthorized access,” the university said on Saturday. The potentially compromised information, Harvard said, includes data related to fundraising and alumni engagement activities, such as addresses, email addresses, phone numbers, donation details, event attendance, and other biographical information. “The information systems that were accessed do not generally contain Social Security numbers, passwords, payment card information, or financial account numbers,” the institution said. Potentially impacted individuals, it said, include alumni, alumni spouses and partners, widows and widowers of alumni, current students, parents of current and former students, donors, and faculty and staff. On November 22, Harvard sent email notifications to the potentially affected people who had an email address in the compromised systems, noting that the scope and impact of the data breach are yet to be determined. The university did not say how many individuals may have had their personal information compromised, but said that it would share additional information on the incident as its investigation progresses. Mirroring a similar intrusion suffered by Princeton University a week before, the data breach was the result of a phone phishing attack. Harvard University is also one of the many victims of the recent Oracle E-Business Suite hacking campaign. Related: Major US Banks Impacted by SitusAMC Hack Related: Columbia University Data Breach Impacts 860,000 Related: Texas Tech University Data Breach Impacts 1.4 Million People Related: University System of Georgia Says 800,000 Impacted by MOVEit Hack

Dartmouth College has disclosed a data breach after the Clop extortion gang leaked data allegedly stolen from the school's Oracle E-Business Suite servers on its dark web leak site. The private Ivy League research university, founded in 1769, has an endowment of $9 billion as of June 30, 2025, over 40 academic departments and programs, and more than 4,000 undergraduate students, with a 7:1 undergraduate-to-faculty ratio. In a breach notification letter filed with the office of Maine's Attorney General, Dartmouth says the attackers exploited an Oracle E-Business Suite (EBS) zero-day vulnerability to steal personal information belonging to 1,494 individuals. However, the total number of people potentially impacted by this data breach is likely much larger, given that the school is headquartered in Hanover, New Hampshire, and it hasn't yet filed a breach notice with the state's Attorney General. "Through the investigation, we determined that an unauthorized actor took certain files between August 9, 2025, and August 12, 2025. We reviewed the files and on October 30, 2025, identified one or more that contained your name and Social Security number," the college says in letters mailed to those affected by the data leak. In a separate appendix filed with Maine's AG, Dartmouth added that the threat actors also stole documents containing the financial account information of impacted individuals. A Dartmouth College spokesperson was not immediately available for comment when contacted by BleepingComputer earlier today regarding the ransom demanded by the Clop gang and the total number of individuals impacted by the breach The incident is part of a much larger extortion campaign in which the Clop ransomware gang has exploited a zero-day flaw (CVE-2025-61882) since early August 2025 to steal sensitive files from many victims' Oracle EBS platforms. While Clop has yet to disclose the total number of impacted organizations, Google Threat Intelligence Group chief analyst John Hultquist has told BleepingComputer that dozens of organizations were likely breached. In the same campaign, the extortion group has also targeted Harvard University, The Washington Post, Logitech, GlobalLogic, and American Airlines subsidiary Envoy Air, with their data also leaked online and now available for download via Torrent. In the past, Clop has also been behind data theft attacks targeting Accellion FTA, GoAnywhere MFT, Cleo, and MOVEit Transfer, the latter impacting over 2,770 organizations. The U.S. Department of State now offers a $10 million reward for information tying the gang's attacks to a foreign government. In recent weeks, Ivy League schools have also been targeted by voice phishing attacks, with Harvard University, Princeton University, and the University of Pennsylvania disclosing that a hacker breached internal systems used for development and alumni activities to steal the personal information of students, alumni, donors, staff, and faculty members. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Cox Enterprises is notifying impacted individuals of a data breach that exposed their personal data to hackers who breached the company network after exploiting a zero-day flaw in Oracle E-Business Suite. The compromise occurred in August, but the company didn’t detect the intrusion until late September, when it launched its internal investigation. “On September 29, 2025, we became aware of suspicious activity involving Oracle’s E-Business Suite, which is a platform we use for some of our back-office business operations,” reads the notice. “We learned the suspicious activity was the result of cybercriminals taking advantage of a previously unknown security flaw (called a “zero-day” vulnerability) in Oracle’s E-Business Suite between Aug. 9-14, 2025.” Cox Enterprises is a major American conglomerate engaged in telecommunications (Cox Communications), and automotive services (Cox Automotive). The company has 55,000 employees and an annual revenue of $23 billion, with its businesses having an international reach. The company has not named the attackers, but the Cl0p ransomware has taken credit for exploiting CVE-2025-61882 as a zero-day vulnerability, long before Oracle released a patch on October 5. Cl0p hackers are known for leveraging zero-days in popular software products used by a large number of organizations. Incidents where Cl0p exploited unknown vulnerabilities include the Cleo file transfer in 2024, the MOVEit Transfer and GoAnywhere MFT in 2023, the SolarWinds Serv-U FTP in 2021, and the Accellion FTA in 2020. Breaches related to Oracle E-Business Suite have been confirmed by multiple companies, among them Logitech, Washington Post, GlobalLogic, Envoy Air, and Harvard University. The threat actor added Cox Enterprises to their data leak website on the dark web on October 27 and published the stolen information. Earlier today, Cl0p listed 29 new companies as their victims. The batch includes major organizations in the automotive, software, and technology sectors. In the notification to 9,479 impacted individuals, Cox provides instructions on how to enroll in identity theft protection and credit monitoring services through IDX at no cost for 12 months. The company did not specify what types of data were exposed in the notification sample shared with authorities. Update 11/22/25: Updated the article to remove reference to 2021 API vulnerability that incorrectly stated it was exploited by attackers. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Progress heeft een kwetsbaarheid verholpen in MOVEit Transfer (Specifiek voor versies vóór 2024.1.8 en van 2025.0.0 tot vóór 2025.0.4). De kwetsbaarheid betreft een server-side request forgery (SSRF). Deze kwetsbaarheid stelt aanvallers in staat om ongeautoriseerde verzoeken vanaf de server te verzenden, wat kan leiden tot ongeautoriseerde toegang tot interne bronnen. Dit kan ernstige gevolgen hebben voor de beveiliging van de interne infrastructuur, of mogelijk toegang tot gevoelige gegevens binnen de context van het slachtoffer.

Logitech discloses data breach after Clop claims Technology manufacturer Logitech filed documents with the Securities and Exchange Commission (SEC) on Friday about a recent cybersecurity incident that involved a zero-day vulnerability. The company told the SEC that an investigation revealed that hackers exploited a bug “in a third-party software platform and copied certain data from the internal IT system.” “The zero-day vulnerability was patched by Logitech following its release by the software platform vendor. The data likely included limited information about employees and consumers and data relating to customers and suppliers,” the company said, adding that the attack did not impact its products, business operations or manufacturing. “Logitech does not believe any sensitive personal information, such as national ID numbers or credit card information, was housed in the impacted IT system.” The attack will not have an impact on the company’s finances and plans to cover any costs with cyber insurance, the company noted. The filing comes one week after the Clop cybercriminal organization claimed it stole information from Logitech through a zero-day vulnerability in Oracle’s E-Business Suite tool. A spokesperson for Logitech declined to confirm whether the incident involved Clop or the zero-day impacting Oracle’s E-Business Suite. Reports from Google and other security firms indicate the hackers used a variety of vulnerabilities in Oracle E-Business Suite to gain access to sensitive data, including at least one zero-day vulnerability that was added to a federal watchlist in September. The Clop cybercriminal group initially attempted to extort corporate executives in October by threatening to leak sensitive information stolen through the application. Oracle confirmed the campaign but initially said the hackers were exploiting bugs that had been addressed in a July update, without specifying which vulnerabilities were being used. FBI Assistant Director Brett Leatherman said that one of the bugs exploited in the campaign is a “‘stop-what-you’re-doing and patch immediately’ vulnerability.” Since then, several organizations have come forward to confirm data theft incidents, including regional American airline Envoy Air and Harvard University. The Washington Post told regulators last week that nearly 10,000 people had information stolen as part of the breach. Since announcing that it was behind the exploitation of the zero-day affecting Oracle E-Business Suite customers, Clop has listed dozens of victims on its leak site. The Russia-based extortion group has earned hundreds of millions of dollars by exploiting unreported vulnerabilities in popular file transfer tools from Cleo, MOVEit, GoAnywhere and Accellion. Jonathan Greig is a Breaking News Reporter at Recorded Future News. Jonathan has worked across the globe as a journalist since 2014. Before moving back to New York City, he worked for news outlets in South Africa, Jordan and Cambodia. He previously covered cybersecurity at ZDNet and TechRepublic.

GlobalLogic, a provider of digital engineering services part of the Hitachi group, is notifying over 10,000 current and former employees that their data was stolen in an Oracle E-Business Suite (EBS) data breach. Based in Santa Clara, California, this software and product development services company was founded in 2000. Since then, it has expanded to 59 product engineering centers and several offices worldwide. In a breach notification letter filed with the office of Maine's Attorney General, the company states that the attackers exploited an Oracle EBS zero-day vulnerability to steal personal information belonging to 10,471 employees. "GlobalLogic's investigation identified access to Oracle and exfiltration on October 9, 2025. We then began drafting and sending out notifications. The investigation has identified the earliest date of threat actor activity as July 10, 2025, with the most recent activity occurring on August 20, 2025," it said. "This incident did not target or impact GlobalLogic's systems outside our Oracle platform, and, based on industry reports, we are one of many Oracle customers believed to have been impacted. The personal information involved in this incident was from our Oracle platform, which includes HR information for current and former personnel." The data stolen in the breach includes personal information collected by GlobalLogic's human resources and, depending on the affected individual, it includes name, address, phone number, and emergency contact (name and phone number). The attackers also exfiltrated the email addresses, dates of birth, nationalities, countries of birth, passport information, national identifiers or tax identifiers (e.g., Social Security Numbers), salary information, and bank account details of impacted employees. Clop's Oracle EBS data theft attacks While GlobalLogic has yet to attribute the breach to a specific threat group, the incident's details align with an extortion campaign in which the Clop ransomware gang exploited a zero-day flaw (CVE-2025-61882) since early August to steal sensitive data from many companies' Oracle EBS systems. Although Clop has yet to disclose the total number of companies affected by these data theft attacks, Google Threat Intelligence Group chief analyst John Hultquist has told BleepingComputer that they believe dozens of organizations were impacted. The extortion gang is now also targeting Harvard University, Envoy Air, and The Washington Post, who have all been added to the cybercrime group's Tor leak site. Their data has also been leaked online and is now available for download via Torrent. Clop has yet to add GlobalLogic to its leak site, which suggests that the company is still negotiating with the threat group or has already paid a ransom. A GlobalLogic spokesperson didn't respond to questions regarding Clop's demands, but confirmed the cybercrime gang "is taking credit for the incident." Clop has been previously linked to other data theft campaigns targeting Accellion FTA, GoAnywhere MFT, Cleo, and MOVEit Transfer, the latter of which has impacted over 2,770 organizations worldwide. The U.S. State Department now offers a $10 million bounty for information that links the ransomware gang's attacks to a foreign government. Update November 12, 03:48 EST: Added GlobalLogic statement. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Cybercriminals have named nearly 30 organizations allegedly impacted by the recent campaign targeting customers of Oracle’s E-Business Suite (EBS) enterprise resource planning solutions. The campaign, which involved extortion emails being sent to executives at dozens of organizations in late September, is believed to have been conducted by a cluster of a profit-driven threat actor tracked as FIN11. The attacks were claimed by the Cl0p (aka Clop) ransomware group. Cl0p was previously linked by the cybersecurity community to FIN11 and the decision to use it as the public-facing entity for the campaign was likely motivated by its prior involvement in similar high-impact campaigns targeting customers of Cleo, MOVEit, and Fortra file transfer products. Twenty-nine alleged victims of the Oracle EBS hack have been listed on the Cl0p leak website to date. The organizations that were the first to be named, such as Harvard University, South Africa’s Wits University, and American Airlines subsidiary Envoy Air, confirmed being impacted shortly after they were named by the attackers in mid-October. Last week, The Washington Post also confirmed it had been successfully targeted in the campaign, but did not share any details, Reuters reported. However, a majority of the other alleged victims have yet to confirm suffering a data breach. SecurityWeek has reached out for comment to several important organizations from the list, but none responded. This includes industrial giants Schneider Electric and Emerson, consumer electronics giant Logitech, communications and automotive giant Cox Enterprises, silver and gold producer Pan American Silver, automotive parts firm LKQ Corporation, and HVAC company Copeland. Other alleged victims include companies in the mining, professional services, wastewater, construction, insurance, financial, manufacturing, transportation, technology, automotive, energy, and HVAC sectors. The organizations impacted by the Oracle EBS hack are likely conducting investigations and some of them likely do not want to share any information until those probes are completed. Others, as past Cl0p attacks have shown, are likely trying to avoid the spotlight by staying silent. The cybercriminals leaked data allegedly stolen from 18 victims, in some cases making public hundreds of gigabytes and even several terabytes of files. SecurityWeek has conducted only a limited structural analysis of some of the leaked files and concluded that they likely originated from an Oracle environment. Given Cl0p’s history, it’s unlikely that organizations have been falsely listed as victims. However, it’s not uncommon for the cybercriminals to deliberately name parent companies as the victim when the actual impact was limited to a smaller subsidiary (as in the case of American Airlines being listed for the Envoy Air hack). It’s also possible that in some cases the hackers have exaggerated the value and sensitivity of the stolen data. It’s still unclear exactly which Oracle EBS vulnerabilities have been exploited in the campaign. The most likely candidates are CVE-2025-61882 and CVE-2025-61884, both of which can be exploited remotely without authentication or user interaction to gain access to sensitive data. In the case of CVE-2025-61882, exploitation as a zero-day appears to have started at least two months prior to patches being released. Related: Sophisticated Malware Deployed in Oracle EBS Zero-Day Attacks Related: State-Sponsored Hackers Stole SonicWall Cloud Backups in Recent Attack

Progress heeft een kwetsbaarheid verholpen in MOVEit Transfer (Specifiek voor versies 2025.0.0 tot 2025.0.3, 2024.1.0 tot 2024.1.7, en 2023.1.0 tot 2023.1.16). De kwetsbaarheid betreft ongecontroleerde resourceconsumptie die kan leiden tot resource-uitputting, wat de prestaties en beschikbaarheid van de getroffen systemen kan beïnvloeden. Een kwaadwillende kan deze kwetsbaarheid misbruiken om de systemen te overbelasten en daarmee een Denial-of-Service te veroorzaken.

Vulnerabilità in MOVEit Transfer Alert AL04/251030/CSIRT-ITA Sintesi Rilevata una vulnerabilità di sicurezza, con gravità “alta”, nel software MOVEit Transfer di Progress. Tale vulnerabilità, qualora sfruttata, potrebbe consentire a un utente malintenzionato di compromettere la disponibilità del servizio sul sistema interessato. Tipologia Denial of Service Prodotti e versioni affette Progress MOVEit Transfer: 2025.0.0, versioni precedenti alla 2025.0.3 2024.1.0, versioni precedenti alla 2024.1.7 2023.1.0, versioni precedenti alla 2023.1.16 Azioni di mitigazione In linea con le dichiarazioni del vendor, si raccomanda di aggiornare i prodotti vulnerabili seguendo le indicazioni del bollettino di sicurezza riportato nella sezione Riferimenti.

The cybersecurity agency CISA has confirmed that an Oracle E-Business Suite (EBS) vulnerability patched earlier this month has been exploited in the wild. Dozens of Oracle customers have been targeted in a campaign that involved data theft from their EBS instances. The cybercriminals, presumably a cluster of a threat group named FIN11, stole significant amounts of files and attempted to extort victims. The attackers exploited EBS vulnerabilities to gain access to data, but Oracle and the cybersecurity community have yet to share definitive information on which flaws have been exploited. Oracle initially said known flaws patched in July were involved, and later announced that a zero-day tracked as CVE-2025-61882 was also apparently exploited in the campaign. A few days later, on October 11, the software giant announced fixes for CVE-2025-61884, which can be exploited remotely without authentication and without user interaction to gain access to sensitive data. However, Oracle’s advisory did not and still does not provide any indication that CVE-2025-61884 has been exploited in attacks. Only the timing of the patch suggested that CVE-2025-61884 too has been leveraged by the attackers. However, CISA on Monday added CVE-2025-61884 to its Known Exploited Vulnerabilities (KEV) catalog, confirming its exploitation. With the flaw added to CISA’s KEV catalog, federal agencies are required to apply mitigations by November 10. Bleeping Computer reported last week that CVE-2025-61884 corresponds to a PoC exploit leaked by Scattered Lapsus$ Hunter (a partnership between the Scattered Spider and ShinyHunters groups) shortly after the Oracle EBS hacking campaign came to light. It was initially believed that the PoC corresponds to CVE-2025-61882. Regardless of which vulnerabilities have been exploited as n-day or zero-day vulnerabilities, it appears that up-to-date Oracle EBS installations should no longer be susceptible to attacks, based on what Bleeping Computer learned from various security firms. The extortion emails sent to victims have been signed by the Cl0p group, which has gained notoriety over the past years, particularly as a result of similar campaigns targeting Cleo, MOVEit, and Fortra file transfer products through the exploitation of zero-day vulnerabilities. At the time of writing, four alleged victims of the Oracle EBS hack have been listed on the Cl0p ransomware leak website: Harvard University, American Airlines (subsidiary Envoy Air), South Africa’s University of the Witwatersrand, and industrial giant Emerson. Emerson is the only one of them that has yet to confirm being impacted and the company has not responded to SecurityWeek’s request for comment. Related: F5 Hack: Attack Linked to China, BIG-IP Flaws Patched, Governments Issue Alerts Related: Hackers Steal Sensitive Data From Auction House Sotheby’s Related: Organizations Warned of Exploited Adobe AEM Forms Vulnerability

Envoy Air, a regional airline carrier owned by American Airlines, confirms that data was compromised from its Oracle E-Business Suite application after the Clop extortion gang listed American Airlines on its data leak site. "We are aware of the incident involving Envoy's Oracle E-Business Suite application," Envoy Air told BleepingComputer. "Upon learning of the matter, we immediately began an investigation and law enforcement was contacted. We have conducted a thorough review of the data at issue and have confirmed no sensitive or customer data was affected. A limited amount of business information and commercial contact details may have been compromised." Envoy Air is a subsidiary of American Airlines and operates regional flights under the American Eagle brand. While it functions as a separate company, it is integrated into American's network for ticketing, scheduling, and passenger service. The Clop ransomware gang is now leaking what they claim to be the data stolen from Envoy on its data leak site, stating, "The company doesn't care about its customers, it ignored their security!!!" This new security incident is related to an August data theft campaign conducted by the Clop extortion group, which began emailing extortion demands to companies in September, claiming to have stolen data from Oracle E-Business Suite systems. While Oracle initially stated that the threat actors were exploiting vulnerabilities patched in July, the company later disclosed that the extortion gang exploited a zero-day flaw tracked as CVE-2025-61882 in the attacks. CrowdStrike and Mandiant later revealed that Clop exploited the flaws in early August to breach systems and deploy malware. While Clop would not share how many companies were impacted by the data theft attacks, Google's John Hultquist told BleepingComputer via email that they believe that dozens of organizations were affected. The Clop gang is also extorting Harvard University as part of this same data theft campaign, with the university confirming to BleepingComputer that the incident impacts a "limited number of parties associated with a small administrative unit." Last week, Oracle silently patched another E-Business Suite zero-day tracked CVE-2025-61884 without disclosing that it was actively exploited in July 2025. This zero-day is linked to an exploit leaked by the Shiny Lapsus$ Hunters extortion group on Telegram. American Airlines previously suffered data breaches in 2022 and 2023 that exposed employees' personal information. Who is Clop? The Clop ransomware operation, also tracked as TA505, Cl0p, and FIN11, launched in 2019 when it began breaching corporate networks to deploy a variant of the CryptoMix ransomware and steal data. Since 2020, the extortion gang shifted from primarily ransomware to exploiting zero-day vulnerabilities in secure file transfer or data storage platforms to steal data. Some of their attacks using zero-day flaws include: 2020: Exploiting a zero-day in the Accellion FTA platform, affecting nearly 100 organizations. 2021: Exploiting a zero-day in SolarWinds Serv-U FTP software. 2023: Exploiting a zero-day in the GoAnywhere MFT platform, breaching over 100 companies. 2023: Exploiting a zero-day in MOVEit Transfer was Clop's most extensive campaign to date, where a zero-day exploit allowed data theft from 2,773 organizations worldwide. 2024: Exploited two Cleo file transfer zero-days (CVE-2024-50623 and CVE-2024-55956) to steal data and extort companies. The U.S. State Department currently offers a $10 million reward for information linking Clop's ransomware activities to a foreign government. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Oracle has issued an emergency security update over the weekend to patch another E-Business Suite (EBS) vulnerability that can be exploited remotely by unauthenticated attackers. Tracked as CVE-2025-61884, this information disclosure flaw in the Runtime UI component affects EBS versions 12.2.3 to 12.2.14 and could allow unauthenticated threat actors to steal sensitive data remotely following successful exploitation. "This vulnerability is remotely exploitable without authentication, i.e., it may be exploited over a network without the need for a username and password. Oracle strongly recommends that customers apply the updates or mitigations provided by this Security Alert as soon as possible," Oracle said. "This vulnerability has received a CVSS Base Score of 7.5. If successfully exploited, this vulnerability may allow access to sensitive resources, added Rob Duhart, Oracle's Chief Security Officer. Oracle released the CVE-2025-61884 patch almost two weeks after a Clop extortion campaign targeting executives at multiple companies, which the company later linked to EBS vulnerabilities patched in July 2025 and then to another Oracle EBS vulnerability now tracked as CVE-2025-61882. Since then, cybersecurity firm CrowdStrike said they first spotted Clop exploiting CVE-2025-61882 as a zero-day since early August in data theft attacks and warned that other threat groups may have also joined the attacks. watchTowr Labs security researchers have also found that CVE-2025-61882 is leaked online by the Scattered Lapsus$ Hunters cybercrime gang. The Clop extortion group was behind other major data theft campaigns targeting zero-days in Accellion FTA, GoAnywhere MFT, Cleo, and MOVEit Transfer, with the latter impacting over 2,770 organizations. Oracle has not tagged the CVE-2025-61884 vulnerability patched over the weekend as exploited in the wild, and has yet to link it to CVE-2025-61882 attacks. However, seeing that internet-facing Oracle EBS instances are actively targeted, defenders are strongly advised to apply the out-of-band CVE-2025-61884 patch as soon as possible. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Oracle over the weekend announced the availability of a patch for another severe E-Business Suite (EBS) vulnerability that can be exploited to gain access to sensitive data. The newly patched flaw is tracked as CVE-2025-61884 and it has been assigned a ‘high severity’ rating. According to Oracle’s advisory, it impacts the Runtime UI component of Oracle Configurator and it can be exploited remotely without authentication and without requiring user interaction. The disclosure and patching of CVE-2025-61884 comes roughly two weeks after executives at dozens of organizations received extortion emails claiming that sensitive information had been stolen from their EBS instance. Oracle initially said the attacks exploited vulnerabilities patched in July 2025. It later admitted that a zero-day tracked as CVE-2025-61882 was also likely exploited. Over the weekend, Oracle informed customers about CVE-2025-61884, but has not said whether it has been exploited. It’s possible that CVE-2025-61884 was discovered during the investigation into CVE-2025-61882 and it may be exploited in similar attacks, but it hasn’t actually been used in the wild. “[CVE-2025-61884] affects some deployments of Oracle E-Business Suite,” said Rob Duhart, the CSO of Oracle. “If successfully exploited, this vulnerability may allow access to sensitive resources.” On the other hand, it’s still unclear exactly which CVEs and CVE combinations have been exploited in the recent attack. The attacks targeting Oracle EBS customers were claimed by the Cl0p group (likely due to its reputation), but Google Threat Intelligence Group (GTIG) and Mandiant have found multiple links to the FIN11 cybercrime group, which has been known to use the Cl0p ransomware in some of its attacks. However, GTIG and Mandiant have yet to confidently attribute the attack to a specific threat group. In addition to exploiting vulnerabilities, the threat actors used sophisticated malware to achieve their goals. The hackers are believed to have stolen significant amounts of data from some of the victims, which is not surprising. Previous large-scale campaigns linked to FIN11 and Cl0p resulted in the theft of sensitive information from Cleo, MOVEit, Fortra and Accellion file transfer products customers. Related: Cisco, Fortinet, Palo Alto Networks Devices Targeted in Coordinated Campaign Related: The Y2K38 Bug Is a Vulnerability, Not Just a Date Problem, Researchers Warn Related: All SonicWall Cloud Backup Users Had Firewall Configurations Stolen

Oracle links extortion campaign to bugs addressed in July patch Software giant Oracle confirmed reports that dozens of its customers have received extortion emails from cybercriminals demanding payment in exchange for not releasing troves of stolen information. In a statement published Thursday evening, Oracle chief security officer Rob Duhart said they are investigating claims made by the Clop ransomware gang that there was a breach of some Oracle E-Business Suite customers. “Our ongoing investigation has found the potential use of previously identified vulnerabilities that are addressed in the July 2025 Critical Patch Update,” Duhart said. “Oracle reaffirms its strong recommendation that customers apply the latest Critical Patch Updates.” The company did not explain which vulnerabilities in the July update were exploited and whether exploitation occurred after the update. Incident responders at Mandiant and Google Threat Intelligence Group (GTIG) released a warning about the incident on Wednesday evening, telling Recorded Future News in an email that they are tracking a campaign launched by a threat actor potentially linked to Clop — a gang that previously made a name for itself with high-profile data thefts involving file transfer tools. The latest campaign, according to the incident responders, involves data the hackers said was stolen through the Oracle E-Business Suite, a widely-used business platform containing several applications that manage finance, human resources and supply chain functions. Genevieve Stark, a senior cybercrime investigator at GTIG, said the team believes the campaign started on September 29 but is still in the early stages of multiple investigations. The extortion emails threaten to either publish victim company data or sell it on the dark web. The Cybersecurity and Infrastructure Security Agency (CISA) would not say whether it is assisting potential victims in response to the extortion emails, instead directing Recorded Future News to a 2023 advisory about Clop. Cynthia Kaiser, former Deputy Director of the FBI’s Cyber Division who now works for incident response firm Halcyon, said the first observed email contact from Clop began in late September. “We have seen seven and eight figure demands thus far,” Kaiser said of Clop’s ransom demands. Kaiser explained that the threat actors shared screenshots and filetree listings to prove they had accessed data, noting that the tactics used aligned with previous Clop campaigns. After emerging in 2019, Clop targeted vulnerabilities in internet-facing file sharing software from Cleo, MOVEit, GoAnywhere and Accellion. Jonathan Greig is a Breaking News Reporter at Recorded Future News. Jonathan has worked across the globe as a journalist since 2014. Before moving back to New York City, he worked for news outlets in South Africa, Jordan and Cambodia. He previously covered cybersecurity at ZDNet and TechRepublic.

Oracle has confirmed that some of its customers have received extortion emails and the software giant’s investigation indicates that the attackers may have exploited known vulnerabilities. Google Threat Intelligence Group (GTIG) and Mandiant revealed this week that executives at many organizations using Oracle’s E-Business Suite (EBS) enterprise resource planning product have received emails claiming the theft of sensitive information. GTIG and Mandiant researchers have yet to confirm the hackers’ claims, but pointed out that the extortion emails claim to come from members of the notorious Cl0p cybercrime group, and the messages have been sent from compromised accounts previously linked to another cybercrime gang tracked as FIN11. Contacted by SecurityWeek, Oracle representatives pointed to a blog post published on Thursday by Rob Duhart, the software giant’s chief security officer. Duhart said the company is aware that some E-Business Suite customers have received extortion emails. “Our ongoing investigation has found the potential use of previously identified vulnerabilities that are addressed in the July 2025 Critical Patch Update,” Duhart explained, without naming the potentially exploited flaws. Oracle fixed roughly 200 vulnerabilities with its July 2025 CPU. Nine patches were released for E-Business Suite, including three for flaws that can be exploited remotely without authentication. These three vulnerabilities, all rated ‘medium severity’, are tracked as CVE-2025-30746, CVE-2025-30745 and CVE-2025-50107. Oracle’s advisory indicates that user interaction is required for their exploitation. Three vulnerabilities fixed in July in E-Business Suite have been assigned a ‘high severity’ rating: CVE-2025-30743, CVE-2025-30744, and CVE-2025-50105. While they do not allow remote exploitation without authentication, their exploitation does not require user interaction. If the involvement of Cl0p and/or FIN11 is confirmed, it should not come as a surprise. Both groups, which are linked, are known to launch campaigns that involve the exploitation of vulnerabilities in software that is used by many organizations to handle sensitive data. Cl0p was behind campaigns targeting Cleo, MOVEit, and Fortra file transfer products. The FIN11 group was behind a campaign that targeted an Accellion file transfer service. All of these campaigns involved the exploitation of zero-day flaws. Earlier this year, Oracle confirmed that hackers managed to steal data from a legacy cloud environment. Related: CISA Issues Guidance After Oracle Cloud Hack Related: Recent Fortra GoAnywhere MFT Vulnerability Exploited as Zero-Day

Oracle customers targeted with emails claiming E-Business Suite breach, data theft Unknown attackers claiming affiliation with the Cl0p extortion gang are hitting business and IT executives at various companies with emails claiming that they have exfiltrated sensitive data from the firms’ Oracle E-Business Suite (EBS). The email campaign According to Google, this high-volume email campaign has been launched from hundreds of compromised accounts in late September 2025. “Our initial analysis confirms that at least one of these accounts has been previously associated with activity from FIN11, a long-running financially motivated threat group known for deploying ransomware and engaging in extortion,” says Charles Carmakal, CTO at Mandiant – Google Cloud. The threat actor is claiming to be affiliated with the Cl0p extortion group, and the emails contain two contact addresses publicly listed on the Cl0p data leak site (DLS). But whether the claims of a data breach or Cl0p involvement are true is currently unknown. “[Google Threat Intelligence Group] does not currently have sufficient evidence to definitively assess the veracity of these claims,” Carmakal added. “Attribution in the financially motivated cybercrime space is often complex, and actors frequently mimic established groups like Clop to increase leverage and pressure on victims.” Citing security firm Halcyon, Bloomberg says the ransom demands are huge, reaching seven and eight figures, and that the attackers shared screenshots and file trees as proof of compromise. (The “proof” has not been independently validated.) The extortion email (Source: Mandiant) The Cl0p ransomware / extortion operation surfaced in 2019 and initially targeted victims with ransomware. But for the last five years, its name has become well known due to attacks exploiting zero-day vulnerabilities in enterprise file transfer solutions such as Accellion FTA and MOVEit. Cl0p attackers abused these flaws to exfiltrate corporate data and demanded that victim organizations pay to prevent the data from being publicly released or sold. What should targeted organizations do? Oracle has not yet commented on the situation. Carmakal advised targeted organizations to investigate their environments for evidence of threat actor activity. “Alongside our industry partners, we have not yet been able to validate whether the claims made by the threat actor are accurate,” Richard Berkahn, a partner at Atmos First Response Australia & New Zealand, shared on LinkedIn, and noted there have previously been instances of fraudsters impersonating the Cl0p gang. “There is every possibility that this is a hoax, although we are treating it as an unvalidated threat at this stage. We are not aware of any validated data exfiltration by entities involved,” he added, and advised organisations that use the Oracle E-Business Suite to check their email filter for any extortion emails that may have been quarantined. “While the email addresses of the threat actor vary, you can also search for ‘pubstorm.com/pubstorm.net’ which should pick up the contents of the email from the threat actor (if you have received them),” he noted. “While this may be another impersonation event, we are advising organisations who have received any emails from the threat actor to prepare as if the threat actor’s claims are legitimate and mobilise their response team (including cyber insurance support if available), to be on the ready to respond as more information becomes known.” UPDATE (October 3, 2025, 07:50 a.m. ET): “Oracle is aware that some Oracle E-Business Suite (EBS) customers have received extortion emails. Our ongoing investigation has found the potential use of previously identified vulnerabilities that are addressed in the July 2025 Critical Patch Update,” Rob Duhart, Chief Security Officer at Oracle Security, has confirmed. “Oracle reaffirms its strong recommendation that customers apply the latest Critical Patch Updates.” UPDATE (October 6, 2025, 07:40 a.m. ET): Cl0p involvement has been confirmed, as well as the fact that they exploited a previously unknown Oracle ESB vulnerability (CVE-2025-61882) in these attacks. Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!

A significant number of organizations have received extortion emails from hackers who claim to have stolen sensitive information from their Oracle E-Business Suite instances, Google’s Threat Intelligence Group and Mandiant unit warn. Oracle E-Business Suite (EBS) is a suite of integrated business applications used by large organizations to automate and manage business processes. Oracle says thousands of organizations around the world use this enterprise resource planning (ERP) system. According to Google Threat Intelligence Group (GTIG) and Mandiant, the malicious activity allegedly targeting Oracle EBS appears to have started on or around September 29. The attackers have sent extortion emails to executives at “numerous” companies, claiming to be affiliated with the notorious Cl0p cybercrime group. GTIG and Mandiant researchers have described the attacks as a high-volume email campaign leveraging hundreds of compromised accounts, including ones previously linked to a profit-driven threat group named FIN11. This long-running cybercrime gang is known to engage in ransomware deployment and extortion. The researchers also found some evidence indicating a connection to Cl0p. Specifically, the contact information provided by the attackers in the emails sent to targeted organizations matches contact addresses listed on the Cl0p leak website. Mandiant and GTIG said they are in the early stages of their investigations and could not confirm whether the hackers’ claims are substantiated. “It is critical to note that while the tactics align with an extortion motive and the actor is explicitly claiming this connection, GTIG does not currently have sufficient evidence to definitively assess the veracity of these claims,” said Charles Carmakal, CTO of Mandiant. Carmakal added, “Attribution in the financially motivated cybercrime space is often complex, and actors frequently mimic established groups like Clop to increase leverage and pressure on victims.” If Cl0p or FIN11 hackers are confirmed to be behind the attacks, it would not come as a surprise. Both groups are known to launch campaigns that target many organizations through vulnerable software, often via the exploitation of zero-day flaws. Cl0p last year claimed to have stolen data from dozens of organizations after exploiting a zero-day vulnerability in Cleo file transfer tools. The group previously managed to steal the information of tens of millions of users from thousands of organizations through the exploitation of a zero-day in MOVEit Transfer file transfer software. In addition, Cl0p was blamed for a 2023 attack that involved a Fortra GoAnywhere managed file transfer product zero-day and which hit dozens of organizations. A few years ago, the FIN11 group was behind a similar campaign that involved the theft of sensitive data from dozens of organizations that had been using an Accellion file transfer service. That campaign also involved the exploitation of a zero-day vulnerability. In some campaigns analyzed in the past, researchers had found links between Cl0p and FIN11. SecurityWeek has reached out to Oracle for comment and will update this article if the company responds. Related: Infostealers: The Silent Smash-and-Grab Driving Modern Cybercrime Related: Recent Fortra GoAnywhere MFT Vulnerability Exploited as Zero-Day

Mandiant and Google are tracking a new extortion campaign where executives at multiple companies received emails claiming that sensitive data was stolen from their Oracle E-Business Suite systems. According to Genevieve Stark, Head of Cybercrime and Information Operations Intelligence Analysis at GTIG, the campaign began in late September. "This activity began on or before September 29, 2025, but Mandiant's experts are still in the early stages of multiple investigations, and have not yet substantiated the claims made by this group," Stark said. Charles Carmakal, CTO of Mandiant – Google Cloud, stated that the extortion emails are being sent from a large number of compromised email accounts. "We are currently observing a high-volume email campaign being launched from hundreds of compromised accounts and our initial analysis confirms that at least one of these accounts has been previously associated with activity from FIN11, a long-running financially motivated threat group known for deploying ransomware and engaging in extortion," Carmakal explained. In an example of the extortion email shared with BleepingComputer, Clop says they breached the company's Oracle E-Business Suite in a data theft attack. "We are CL0P team. If you haven't heard about us, you can google about us on internet," reads the extortion email shared with BleepingComputer. "We have recently breached your Oracle E-Business Suite application and copied a lot of documents. All the private files and other information are now held on our systems." "But, don't worry. You can always save your data for payment. We do not seek political power or care about any business. So, your only option to protect your business reputation is to discuss conditions and pay claimed sum." "In case you refuse, you will lose all abovementioned data: some of it will be sold to the black actors, the rest will be published on our blog and shared on torrent trackers." Mandiant and GTIG report, and BleepingComputer has confirmed, that the email addresses listed in the extortion email are the same as those on the Clop ransomware gang's data leak site, indicating a possible link to the extortion group. However, Carmakal says that while the tactics are similar to Clop's previous extortion campaigns and the email addresses indicate a potential link, there is not enough evidence to determine if data has actually been stolen. Mandiant and GTIG recommend that organizations receiving these emails investigate their environments for unusual access or compromise in their Oracle E-Business Suite platforms. After publishing this story, Clop claimed to BleepingComputer that they are involved in the extortion email, indicating a bug in Oracle's product was exploited in the attacks. However, the threat actors would not share more detailed information about the alleged attacks. "We not prepared to discuss details at this time," Clop told BleepingComputer. "Soon all will become obvious that Oracle bugged up their core product and once again, the task is on clop to save the day. We do not damage to systems and only expect payment for services we provide to protect hundreds of biggest companies in world." Oracle also published a brief post today by Rob Duhart, Chief Security Officer, Oracle Security, who said that they believe the threat actors exploited vulnerabilities patched in the July 2025 security updates. "Our ongoing investigation has found the potential use of previously identified vulnerabilities that are addressed in the July 2025 Critical Patch Update," explained Duhart. "Oracle reaffirms its strong recommendation that customers apply the latest Critical Patch Updates." If you have any information regarding this incident or any other undisclosed attacks, you can contact us confidentially via Signal at 646-961-3731 or at [email protected]. Who is the Clop extortion gang? The Clop ransomware operation, also tracked as TA505, Cl0p, and FIN11, launched in March 2019 when it began targeting enterprise networks with a variant of the CryptoMix ransomware. Like other ransomware gangs, Clop members breach corporate networks, steal data, and then deploy ransomware to encrypt systems. The stolen data and encrypted files are then used as leverage to force companies to pay a ransom demand in exchange for a decryptor and to prevent the leaking of the stolen data. While the group is still known to deploy ransomware, since 2020, they have shifted to exploiting zero-day vulnerabilities in secure file transfer platforms to steal data. Some of their most notable attacks include: 2020: Exploiting a zero-day in the Accellion FTA platform, affecting nearly 100 organizations. 2021: Exploiting a zero-day in SolarWinds Serv-U FTP software. 2023: Exploiting a zero-day in the GoAnywhere MFT platform, breaching over 100 companies. 2023: Exploiting a zero-day in MOVEit Transfer was Clop's most extensive campaign to date, where a zero-day exploit allowed data theft from 2,773 organizations worldwide. The most recent campaign associated with Clop was in October 2024, when the threat actors exploited two Cleo file transfer zero-days (CVE-2024-50623 and CVE-2024-55956) to steal data and extort companies. The U.S. State Department currently offers a $10 million reward through its Rewards for Justice program for information linking Clop's ransomware activities to a foreign government. Update 10/2/25: Added sample of Clop extortion email being sent to companies. Update 10/2/25 07:42 PM ET: Added statement from the Clop ransomware gang and further info from Oracle. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Two teenagers, believed to be linked to the August 2024 cyberattack on Transport for London, have been arrested in the United Kingdom. Believed to be members of the notorious Scattered Spider hacking collective, 18-year-old Owen Flowers from Walsall and 19-year-old Thalha Jubair from East London are scheduled to appear at Westminster Magistrates Court today. Flowers was previously arrested for his alleged involvement in the TfL attack in September 2024, but was released on bail after being questioned by officers of the UK National Crime Agency. Since then, NCA investigators have found additional evidence potentially linking Flowers to attacks against U.S. healthcare companies. The two suspects are being prosecuted for computer misuse and fraud-related charges linked to an investigation into the breach of London's public transportation agency. Additionally, Flowers faces charges for conspiring to attack the networks of SSM Health Care Corporation and Sutter Health in the United States. "This attack caused significant disruption and millions in losses to TfL, part of the UK's critical national infrastructure," said Deputy Director Paul Foster, the head of the NCA's National Cyber Crime Unit. "Earlier this year, the NCA warned of an increase in the threat from cyber criminals based in the UK and other English-speaking countries, of which Scattered Spider is a clear example." Links to at least 120 network breaches The U.S. Department of Justice has also charged Thalha Jubair today with conspiracy to commit computer fraud, money laundering, and wire fraud. These charges relate to at least 120 network breaches, including attacks on critical infrastructure entities and U.S. Courts, as well as extortion attacks worldwide. The incidents occurred between May 2022 and September 2025, impacting at least 47 U.S. organizations. "These malicious attacks caused widespread disruption to U.S. businesses and organizations, including critical infrastructure and the federal court system, highlighting the significant and growing threat posed by brazen cybercriminals," the Justice Department said. The complaint, filed in the District of New Jersey and unsealed today, alleges that victims have paid Jubair and his accomplices at least $115,000,000 in ransom payments. "Collectively, victims paid more than $115 million to Jubair and his associates in efforts to recover their data and prevent its disclosure. Portions of the ransom payments from at least five victims were sent to wallets on a server controlled by Jubair," the Justice Department added. "In July 2024, while law enforcement was seizing that server — including successfully seizing cryptocurrency worth approximately $36 million at the time of the seizure — Jubair transferred a portion of cryptocurrency that originated from one of the victims, worth approximately $8.4 million at the time, to another wallet." The Transport for London cyberattack TfL disclosed the August 2024 cyberattack on September 2, 2024, stating that it had not found evidence that any customer data was compromised in the breach. While the attack did not affect London's transportation services, it did disrupt internal systems and online services, as well as TfL's ability to process refunds. In a subsequent update, TfL revealed that customer data, including names, contact details, and addresses, had actually been compromised during the incident. TfL provides transportation services to over 8.4 million Londoners through its surface, underground, and Crossrail transport systems, jointly managed with the UK's Department for Transport. In May 2023, TfL was the victim of another security breach after the Clop ransomware gang stole data belonging to over 13,000 customers from one of its suppliers' MOVEit Managed File Transfer (MFT) servers. The NCA arrested four other suspected members of the Scattered Spider cybercrime collective in July, believed to be involved in cyberattacks targeting major retailers in the country, including Marks & Spencer, Harrods, and Co-op. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

SYSTEMS AMD inches closer to its goal of making AI suck less ... energyHouse of Zen claims latest systems already 4x more efficient than two years ago Google pits Marvell against Broadcom as it chases AI crownAnd Marvell just offered the Chocolate Factory a $12.2B stake to sweeten the deal SYSTEMS Cerebras CS-4 rack systems juice chips for every last drop of AI performanceNext-gen systems double per-chip performance while cramming 3x as many into a rack Security Copilot tricked into telling reseachers how to hack itselfHow to social engineer an AI's reasoning engine AI and ml Payments giant Stripe is about to drop over $7 billion to become a gateway to AI token salesAI gateways look promising as companies struggle with model orchestration Security Russians are posing as Signal support to launch phishing attacksPLUS: US takes down Iranian propaganda sites; Marketing company asks 'Why Do We Have Your Information?' And more! Security Microsoft patches failed to fix on-prem SharePoint, which is now under zero-day attackPLUS: China upgrades smartphone surveillance tools; Ring eases anti-snooping stance; and more Black Hat and DEF CON DEF CON Franklin project enlists hackers to harden critical infrastructureVoting village reports have been so successful, says Jeff Moss, that the whole of DEF CON will now be included Security EQT buys majority share in Swiss cybersecurity biz AcronisWent at equivalent of $3.5B+ valuation for entire firm, though portion sold not specified Malware Month Ten years since the first corp ransomware, Mikko Hyppönen sees no end in sightOn the plus side, infosec's a good bet for a long, stable career FOSS smashed one Microsoft monopoly. After 20 years of failure, it's time to smash anotherWord up GNOME can look like Windows – and Flashback can do it without extensionsNew 'Simple-taskbar' is an option, but there's a simpler, stabler way A moment of silence, please, for the final release of Debian on x86-32New Debian versions hit FOSSland in the form of 13.6 and 12.15 Baddies caught exploiting extensions bugs with perfect 10 scores on vulnerable Joomla websitesFlaws in iCagenda, Balbooa Forms extensions can impact open source CMS that powers a million sites worldwide Frame: A new X11 server – implemented directly in assemblyJoins yserver, Phoenix, and of course XLibre – and outlier Arcan Cinnamon 6.8 will support Wayland – if you want itNext version of Linux Mint’s desktop has both kinds of display server