Google Issues Alert on CL0P Ransomware Actively Exploiting Oracle E-Business Suite Zero-Day

According to Google Threat Intelligence Group (GTIG) and Mandiant, a massive email campaign began targeting executives from 29 September 2025, attempting to exfiltrate data from Oracle E-Business Suite environments and using compromised third‑party accounts to deliver legitimate file listings dating back to mid-August.

Organizations using Oracle E-Business Suite must apply the October 4 emergency patches immediately to mitigate the active, in‑the‑wild exploitation by CL0P extortion actors and hunt for malicious templates in their databases. Oracle reported on 2 October that exploited vulnerabilities had been patched in July’s Critical Patch Update and urged customers to apply the latest CPU; two days later Oracle released emergency fixes specifically addressing CVE‑2025‑61882.

The campaign is linked to a multi‑stage Java implant framework that uses Server‑Side Request Forgery, CRLF injection, authentication bypass, and XSL template injection to achieve remote code execution, with initial exploitation touching UiServlet and SyncServlet components by August 9.

In August, attackers abused SyncServlet via POST /OA_HTML/SyncServlet and uploaded malicious XSL payloads through the XDO Template Manager, leading to an in‑memory Java implant that can run commands under the applmgr account, including system reconnaissance and reverse shells. Authors urge defenders to patch promptly and monitor for indicators such as TEMPLATE_CODE entries beginning with TMP or DEF and unusual activity targeting /OA_HTML/configurator/UiServlet and /OA_HTML/SyncServlet.