CL0P-Linked Hackers Breach Dozens of Organizations Through Oracle Software Flaw

According to Google Threat Intelligence Group (GTIG) and Mandiant in a new report, dozens of organisations may have been impacted by a zero-day flaw in Oracle’s E-Business Suite (EBS) that was exploited from 9 August 2025, with patches subsequently issued by Oracle. The exploitation is linked to the Cl0p ransomware crew, with GTIG noting the activity bears hallmarks associated with Cl0p and that the group’s name features in the campaign’s branding.

The attackers reportedly used a chain of vulnerabilities, including a zero-day tracked as CVE-2025-61882 (CVSS 9.8), to breach networks and exfiltrate data, with evidence of additional suspicious activity dating back to 10 July 2025. The latest wave formalised from 29 September 2025, beginning with a high-volume phishing campaign targeting executives from compromised third-party accounts, and files containing payloads such as GOLDVEIN.JAVA and a SAGEGIFT loader leading to SAGELEAF and SAGEWAVE.

While Google cautions there is no definitive attribution to a single threat group, the report notes overlaps with FIN11 tools and that one breached account was previously used by FIN11. The article also states that Cl0p has a history of exploiting multiple zero-days across enterprise software, and that Oracle has issued patches to address the vulnerability.