Sophisticated Malware Deployed in Oracle EBS Zero-Day Attacks

Google Threat Intelligence Group (GTIG) and Mandiant have continued to analyse the Oracle E-Business Suite (EBS) extortion campaign, identifying multiple pieces of malware deployed in the attacks. Exploitation may have begun as early as July 10, with CrowdStrike later reporting that exploitation started on August 9, and GTIG and Mandiant noting that some activity occurred in July just before Oracle’s July patches; Google researchers believe dozens of organisations were affected.

The attackers used malicious templates in vulnerable Oracle EBS databases to deliver a multi-stage, fileless chain, with a downloader dubbed GoldVein.Java and a nested chain where SageGift loads SageLeaf, which installs SageWave to enable the final payload, though researchers could not retrieve that payload. The final payloads are described as sophisticated, multi-stage, and designed to evade file-based detection.

The Cl0p extortion group name has been used in the emails, but GTIG and Mandiant have found links to FIN11, based on compromised email accounts and malware similarities; they have not attributed the campaign to a specific threat actor, and there is no evidence tying Scattered LAPSUS$ Hunters to the Oracle campaign. According to Oracle, CVE-2025-61882 allows unauthenticated remote code execution. Dozens of organisations are reported to have been affected, with significant data potentially stolen.