⚡ Weekly Recap: WhatsApp Worm, Critical CVEs, Oracle 0-Day, Ransomware Cartel & More

According to Google Threat Intelligence Group (GTIG) and Mandiant, dozens of organisations may have been impacted by the exploitation of Oracle E-Business Suite in a zero-day campaign since 9 August 2025, with activity bearing hallmarks of the Cl0p ransomware crew.

The attackers reportedly used multiple vulnerabilities, including the zero-day CVE-2025-61882 (CVSS 9.8), to breach networks and exfiltrate data, triggering two different payload chains that dropped families such as GOLDVEIN.JAVA, SAGEGIFT, SAGELEAF, and SAGEWAVE. Oracle has released updates to EBS to address another vulnerability in the same product, CVE-2025-61884, which could lead to unauthorized access to data, though Oracle did not say whether it was being exploited in the wild.

The campaign is described as combining several flaws to achieve access, and the discovery underscores the need for rapid patching and monitoring of critical vulnerabilities. This recap also notes related developments around CVEs and other threat activity, illustrating how threat actors tie together flaws across targets.