Attackers claiming affiliation with the CL0P extortion operation targeted organizations running Oracle E-Business Suite (EBS), alleging that they had stolen business data and demanding payment. Google Threat Intelligence Group and Mandiant found suspicious activity dating to at least July 10, 2025, with likely zero-day exploitation beginning around August 9—weeks before extortion emails reached executives on September 29.
The initial public assessment was that dozens of organizations were affected. Later reporting suggested the number may have approached 100, but there is no authoritative public victim census. The campaign targeted customer-operated or customer-exposed EBS environments—not Oracle’s entire cloud portfolio or, based on the reviewed evidence, Oracle’s corporate infrastructure.
As an Amazon Associate I earn from qualifying purchases.
What happened
Google and Mandiant described a campaign involving multiple exploit chains against Oracle EBS environments. The reported sequence was:
Recommended Free Tools
- July 10, 2025: Suspicious activity targeting EBS servers was identified.
- August 9, 2025: Likely exploitation of a previously unknown vulnerability began.
- September 29, 2025: Extortion emails began reaching executives at numerous organizations.
- October 2, 2025: Oracle advised customers to apply current updates after receiving reports of alleged exploitation.
- October 4, 2025: Oracle issued an emergency alert for CVE-2025-61882, later revised October 6.
- October 9, 2025: Google and Mandiant published their campaign analysis.
- October 11, 2025: Oracle issued an additional alert addressing CVE-2025-61884.
Google and Mandiant said the activity included data theft followed by extortion. However, the public evidence did not establish that every recipient of an extortion email had a confirmed compromise or that every incident was handled by one unified criminal group.
#1 Best Overall
This was an Oracle E-Business Suite campaign—not a blanket Oracle breach
Oracle E-Business Suite is a collection of enterprise applications used for functions such as finance, procurement, human resources, supply-chain operations and reporting. An organization may run EBS on its own servers, in a public-cloud account or through a managed service provider.
That distinction matters. The available evidence describes attackers exploiting customer environments that exposed EBS systems to the internet. It does not establish that Oracle Cloud infrastructure or Oracle’s corporate systems were breached. Responsibility for patching, logging, network controls and forensic access depends on how each customer deployed and hosted EBS.
The vulnerabilities involved
CVE-2025-61882
Oracle’s October 4 alert identified CVE-2025-61882 in the Oracle Concurrent Processing component, specifically BI Publisher Integration. Oracle described it as:
Free tools Windows power users keep installed
One-click scans. No signup required.
- Remotely exploitable over HTTP;
- Exploitable without authentication;
- Rated 9.8 Critical under CVSS 3.1; and
- Affecting supported EBS versions 12.2.3 through 12.2.14.
The flaw could enable remote code execution and takeover of Oracle Concurrent Processing. Oracle’s technical risk matrix provides additional component and scoring detail in its text-form advisory.
CVE-2025-61884 and multiple exploit chains
Oracle issued a separate alert for CVE-2025-61884 on October 11. It should not be treated as the same vulnerability as CVE-2025-61882.
Google and Mandiant observed more than one exploit chain, but said the exact relationship between the observed chains and the public CVEs remained unclear. It is therefore not established that CVE-2025-61882 was used in every attack.
Oracle’s alert specifically covers supported versions 12.2.3 through 12.2.14. Older or unsupported versions may also be at risk, but Oracle said those versions were not tested under the alert and recommended upgrading to a supported release.
How the attackers operated
The reported intrusion activity went beyond simply exploiting an internet-facing application. Google and Mandiant described:
- A multi-stage Java implant framework;
- Malicious payloads stored directly in the EBS database;
- Outbound connections from affected environments to attacker-controlled infrastructure;
- Theft of files and other data; and
- Extortion emails sent after the alleged data access.
Database-resident payloads are particularly important because conventional endpoint tools may not reveal malicious content stored inside legitimate application structures. Investigators were advised to examine the XDO_TEMPLATES_B and XDO_LOBS tables for suspicious records, especially unexpected template codes beginning with TMP or DEF.
SELECT * FROM XDO_TEMPLATES_B ORDER BY CREATION_DATE DESC;
SELECT * FROM XDO_LOBS ORDER BY CREATION_DATE DESC;These queries are starting points, not proof of compromise. Results should be correlated with EBS application logs, database audit records, web-server logs, Java process history, proxy data and outbound network connections.
How credible were the extortion emails?
The messages reportedly came from hundreds, potentially thousands, of compromised third-party accounts, likely sourced from infostealer logs sold on criminal forums. A sender using an unrelated domain therefore does not automatically make the message fraudulent.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Some recipients reportedly received file listings from their own environments as proof. Google said the material shown to victims included data dating back to mid-August 2025. A matching internal document, database record or file listing should be treated as a potential compromise indicator—but the email itself is not conclusive proof.
Organizations receiving a message should preserve the original email and complete headers, avoid replying casually, and route the matter through a trusted incident-response process.
How many organizations were affected?
The figures describe different populations and should not be conflated:
| Term | Meaning |
|---|---|
| Email recipients | Organizations contacted by the extortion operation. |
| Alleged victims | Organizations named or described in attacker communications. |
| Confirmed compromises | Organizations that independently verified unauthorized access. |
| Confirmed data theft | Organizations that established that information left the environment. |
Google and Mandiant’s initial assessment was that dozens of organizations were affected. Later CyberScoop reporting suggested the campaign may have reached nearly 100 organizations. That later figure is not a final, authoritative victim count, and the number of extortion recipients cannot be assumed to equal the number of confirmed compromises.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallWas Clop definitively responsible?
The safest description is that the campaign was associated with actors claiming affiliation with the CL0P extortion brand. Multiple pieces of evidence supported that connection, but public reporting did not establish that every email, exploit chain or victim was handled by one group.
Google also said it did not assess that actors associated with UNC6240, also known as ShinyHunters, were responsible for the exploitation activity. Accordingly, “Clop hacked every Oracle customer” is stronger than the evidence supports.
Was stolen data published?
As of Google and Mandiant’s October 9, 2025 analysis, Google had not observed victims from this campaign on the CL0P data-leak site. That observation did not prove that no data had been stolen. Extortion groups may delay publication, negotiate privately or use other disclosure channels.
The status should therefore be stated with its date: no campaign victims had been observed on the leak site at the time of that analysis—not that publication was permanently ruled out.
What Oracle EBS customers should do
1. Confirm your exposure
Inventory public IP addresses, reverse proxies, load balancers and remote-access paths. Determine whether EBS or related components were reachable over HTTP from untrusted networks. If a managed service provider hosts the system, obtain written confirmation of its patching, logging and investigation responsibilities.
2. Apply all relevant Oracle updates
Apply Oracle’s alert for CVE-2025-61882, the October 11 update addressing CVE-2025-61884, and applicable updates in the October 2025 Critical Patch Update. Contact Oracle Support if the environment is affected or cannot be patched normally.
Patching is mandatory, but it is not a compromise assessment. It addresses the vulnerable condition; it does not remove an implant, invalidate stolen credentials or retrieve data already exfiltrated.
3. Hunt the EBS database and application
Review recent and unexpected entries in XDO_TEMPLATES_B and XDO_LOBS, with particular attention to suspicious TMP or DEF template codes. Correlate findings with database, EBS, web, Java and network telemetry.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
4. Review outbound traffic
Look for unexplained EBS-to-internet connections, unexpected Java downloads and traffic to attacker infrastructure. Restrict EBS outbound access to required destinations where operationally safe, while checking that integrations and support workflows will continue to function.
Oracle’s advisory includes observed indicators such as 200[.]107[.]207[.]26 and 185[.]181[.]60[.]11, as well as commands and SHA-256 hashes associated with exploit and server files. Use the official Oracle alert for the complete indicator set rather than relying on a copied list.
5. Preserve evidence before cleanup
- Retain extortion emails and complete headers.
- Preserve database audit logs, web access logs, proxy logs, firewall records and EBS application logs.
- Record patch installation times and system changes.
- Snapshot affected systems before remediation where operationally safe.
- Document missing or rotated logs instead of treating their absence as evidence of no intrusion.
6. Assess business and legal impact
Determine whether attackers could access financial, payroll, employee, customer, procurement or regulated data. Also assess exposed credentials, API keys, session tokens and downstream integrations. Rotate credentials and secrets when compromise is suspected, and involve legal, privacy, regulatory, insurance and law-enforcement teams as required.
Payment is not a technical remedy. It cannot restore trust in the environment, reverse exfiltration or guarantee deletion. Any payment decision requires legal counsel, sanctions screening, insurers and executive risk owners.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteWhat remains unknown
- The final number of affected organizations;
- The complete list of victims and stolen data;
- Which exploit chain was used against each organization;
- Whether every extortion email came from the same operators;
- How many recipients confirmed unauthorized access; and
- Whether or when additional data would be published.
The central lesson is that a patched EBS server may still require a forensic investigation. Enterprise application systems combine valuable business data, complex legacy components and integrations with finance, HR and supply-chain systems. Attackers can exploit that combination quietly, steal data and wait weeks before making their presence visible.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
