Clop Ransomware Group Exploits New 0-Day Vulnerabilities in Active Attacks

The Clop ransomware group is described as continuing to pose a significant threat to enterprise organisations worldwide, with recent analysis noting their exploitation of a critical zero-day vulnerability in Oracle E-Business Suite. Operating since early 2019, Clop is said to have impacted more than 1,025 organisations and extorted over $500 million since its inception. The article notes that the group is a suspected variant linked to CryptoMix and tends to avoid CIS countries, with origins traced back to Russia.

A key distinguishing feature is their regular use of zero-day vulnerabilities, underscoring their technical sophistication and intelligence gathering. Recent findings tie the Oracle EBS exploit to CVE-2025-61882, a critical flaw enabling compromise of ERP systems, and outline indicators such as two outbound Oracle IP addresses (185.181.60[.]11 and 200.107.207[.]26) associated with initial reconnaissance.

The piece also connects current activity to historical campaigns, including the MOVit vulnerability (CVE-2023-34362) and the Fortra GoAnywhere exploit (CVE-2023-0669), highlighting persistent infrastructure patterns across campaigns. 5 November 2025.