Cl0p exploits Oracle EBS zero-day, extortion emails prompt patch

Security researchers and Oracle say a campaign by the Cl0p ransomware group exploited multiple flaws in Oracle EBusiness Suite beginning in August, including a critical zero day patched this weekend, to steal data from dozens of organizations and send mass extortion emails to corporate executives. Oracle published an emergency security alert on October 4 identifying the zero day as CVE-2025-61882, a remotely exploitable unauthenticated remote code execution flaw affecting the BI Publisher Integration component of Oracle Concurrent Processing in EBusiness Suite versions 12.2.3 through 12.2.14, and urged customers to apply updates immediately.

Oracle said the vulnerability "is remotely exploitable without authentication, i.e., it may be exploited over a network without the need for a username and password." The company released patches and indicators of compromise, including IP addresses, observed commands and file hashes, to help customers hunt for signs of intrusion. Oracle also noted that some victims previously received extortion emails and that its investigation uncovered additional potential exploitation during the probe.

Researchers at Google Threat Intelligence Group and...