Google, Mandiant expose malware and zero-day behind Oracle EBS extortion

Google Threat Intelligence and Mandiant link Oracle EBS extortion emails to known July-patched flaws and a likely zero-day, CVE-2025-61882. They tracked activity in early October and observed extortion notes to executives, with the attackers potentially tied to the Cl0p ransomware group via one email and contacts. Oracle released an emergency patch to address CVE-2025-61882, which affects Oracle E-Business Suite 12.2.3–12.2.14 (BI Publisher Integration).

CrowdStrike researchers attributed the exploitation to the Cl0p group with a CVSS of 9.8, and GTIG highlighted two Java payload chains embedded in XSL payloads: GOLDVEIN.JAVA (a downloader) and the SAGE infection chain (including SAGEGIFT, SAGELEAF and SAGEWAVE). Post‑exploitation activity included reconnaissance from the applmgr EBS account and the spawning of interactive bash -i shells, with guidance to hunt child processes of any such shells launched by Java running as applmgr.

GTIG has not attributed the attacks to a single group, but overlaps suggest ties to FIN11 and CL0P, with one compromised account previously used by FIN11. Google concludes the approach of using zero‑days, limiting network footprint, and delaying extortion notifications increases impact, and warns that threat actors are likely to continue developing weaponized exploits for similar applications.