CL0P Extortion: Google/Mandiant Expose Zero-Day RCE in Oracle E-Business Suite (CVE-2025-61882)

According to Google Threat Intelligence Group (GTIG) and Mandiant, an extensive data theft and extortion campaign targeting Oracle E-Business Suite environments has been disclosed, with threat actors claiming affiliation to the CL0P extortion brand. The campaign, beginning in late September 2025, leverages what appears to be a previously unknown zero-day vulnerability, CVE-2025-61882, in Oracle EBS, and has exploited the UiServlet and SyncServlet components to achieve remote code execution.

Exploitation was observed as early as July 10, 2025, with corroborating activity dating to August 9, 2025, weeks before patches were available; Oracle subsequently released emergency patches on 4 October 2025.

Initial intrusions involved the /OA_HTML/configurator/UiServlet endpoint and later the /OA_HTML/OA.jsp?page=/oracle/apps/xdo/oa/template/webui/TemplatePreviewPG path, using SSRF, CRLF injection, authentication bypass and XSL template injection alongside Java-based implants such as GOLDVEIN.JAVA, SAGEGIFT, SAGELEAF and SAGEWAVE.

While GTIG has not confirmed attribution, there are notable overlaps with historical FIN11 operations and the CL0P DLS infrastructure, and the attackers have used high-volume email campaigns to touch executives and provide purported proofs of intrusion.