Extortion emails target Oracle EBusiness Suite, breach not confirmed

Security researchers said this week that an unknown actor or group has sent a high-volume campaign of extortion emails since Sept. 29 to executives at multiple organizations, claiming to have stolen sensitive data from Oracle EBusiness Suite installations. The messages, which appear to originate from hundreds of compromised third-party accounts, urge recipients to contact the extortionists and list contact addresses that researchers say are publicly associated with the Clop data leak site.

Mandiant at Google Cloud and the Google Threat Intelligence Group are among the teams investigating the activity but caution that they have not yet validated the attackers claims of a successful breach or confirmed Clop involvement. We are currently observing a high-volume email campaign being launched from hundreds of compromised accounts, Mandiant CTO Charles Carmakal said. Genevieve Stark, head of cybercrime and information operations intelligence analysis at the Google Threat Intelligence Group, said investigators do not yet have evidence of a specific malware family or of confirmed data exfiltration tied to this campaign.

Researchers reported that at least one of the compromised accounts...