Update on the emerging CL0P extortion campaign targeting Oracle E-Business Suite

According to Oracle Security Alert for CVE-2025-61882, CL0P extortionists are targeting Oracle E-Business Suite and likely exploited a zero-day vulnerability to exfiltrate data. The campaign was active in August 2025, with the actor reportedly stealing large volumes of data, in some cases described as terabytes, during negotiations that followed the theft. The vulnerability CVE-2025-61882 is described as critical, with a CVSS of 9.8, allowing unauthenticated remote code execution.

Oracle has released a security alert and patches, and the article thanks Oracle, Google Threat Intelligence Group, and Mandiant (part of Google Cloud) for their collaboration. Organisations are urged to investigate their environments for evidence of historical compromise and to search email content for specific addresses to identify if they are being extorted by CL0P. 6 October 2025.