Google warns of Cl0p extortion campaign against Oracle E-Business users

Google has warned of a Cl0p extortion campaign targeting Oracle E-Business Suite users, with emails sent to executives claiming data from Oracle systems has been stolen. According to Bloomberg, the group demanded ransoms up to $50 million, and at least one company has confirmed that data from its Oracle systems was breached.

Mandiant and Google Threat Intelligence Group researchers say attackers likely hacked user emails and exploited Oracle E-Business Suite’s default password reset to obtain valid credentials, enabling data theft. They are observing a high-volume extortion campaign launched from hundreds of compromised accounts, with some accounts linked to FIN11, a financially motivated threat group.

Google’s investigators note that the extortion notes include Cl0p site contacts and ties to a Cl0p affiliate, though proof of attribution remains lacking. The findings come as Halcyon and Mandiant emphasise ongoing investigations and indicators of compromise associated with Cl0p activity.