Google Mandiant Probes New Oracle Extortion Wave Possibly Linked to Cl0p Ransomware

Google Mandiant and Google Threat Intelligence Group (GTIG) say they are tracking a new cluster of activity possibly linked to a financially motivated threat actor known as Cl0p. The activity involves sending extortion emails to executives at various organisations, claiming to have stolen data from their Oracle E-Business Suite.

Mandiant CTO Charles Carmakal described it as a high-volume email campaign launched from hundreds of compromised accounts, with at least one account previously associated with FIN11, a subset within the TA505 group. The emails contain contact details that are publicly listed on the Cl0p data leak site, a move Google says strongly suggests an association with Cl0p, though Google states it has no evidence on its own to confirm the ties.

The activity began on or before 29 September 2025, and Bloomberg is cited as noting that attackers may have compromised user emails and abused a default password reset function to obtain credentials for Oracle E-Business Suite portals. The Hacker News has contacted Oracle for comment and will update the story if there is a response.