Google Warns of CL0P Ransomware Group Actively Exploiting Oracle E-Business Suite Zero-Day
A new threat has emerged in the cybersecurity domain as the CL0P ransomware group initiates an extensive extortion campaign targeting Oracle E-Business Suite (EBS) environments.
A new threat has emerged in the cybersecurity domain as the CL0P ransomware group initiates an extensive extortion campaign targeting Oracle E-Business Suite (EBS) environments.
Beginning on Fri, Sep 29, 2025, security researchers observed a sophisticated operation linked to the CL0P extortion brand. This campaign involved a high-volume email attack aimed at executives across various organizations.
The campaign exploits CVE-2025-61882, a zero-day vulnerability in Oracle EBS environments, with exploitation activities traced back to Thu, Jul 10, 2025.
Oracle reported on Thu, Oct 2, 2025, that attackers might have exploited vulnerabilities addressed in July 2025. Emergency patches were released on Sat, Oct 4, 2025, following the discovery of active exploitation.
The campaign has led to successful data exfiltration from multiple affected organizations.
Google Cloud analysts have identified a multi-stage attack methodology used by the threat actors. This involves exploiting Oracle EBS servers through a complex vulnerability chain. The attackers used compromised third-party email accounts to send extortion emails to company executives.
The emails contained contact addresses associated with the CL0P data leak site since at least May 2025.
Beginning on Fri, Sep 29, 2025, security researchers observed a sophisticated operation linked to the CL0P extortion brand.
Google Threat Intelligence Group has documented evidence of legitimate file listings from victim EBS environments, supporting the extortion claims with data dating back to mid-August 2025.
The threat actors have indicated that victims can prevent the release of stolen data in exchange for payment, although specific amounts and methods have not been disclosed.
Multi-Stage Java Implant Framework Deployment
The CL0P operation demonstrates sophistication through a multi-stage Java implant framework designed for Oracle EBS compromise. The primary attack vector exploits the SyncServlet component, allowing unauthenticated remote code execution.
Attacks begin with POST requests to /OA_HTML/SyncServlet and leverage the XDO Template Manager functionality to create malicious templates within the EBS database.
The exploit chain showcases advanced technical capabilities, with payloads stored as new templates in the XDO_TEMPLATES_B database table.
Template names consistently begin with the prefixes "TMP" or "DEF", with TemplateType set to "XSL-TEXT" or "XML", respectively.
The malicious XSL payload structure follows this format:
<?xml version="1.0" encoding="UTF-8"?> <xsl:stylesheet version="1.0" xmlns:xsl="http://www.w3.o" xmlns:b64="http://www.orac" xmlns:jsm="http://www.orac" xmlns:eng="http://www.orac" xmlns:str="http://www.orac"> <xsl:template match="/"> <xsl:variable name="bs" select="b64:decode"/> <xsl:variable name="js" select="str:new"/> <xsl:value-of select="$code"/> </xsl:template> </xsl:stylesheet>
The framework includes two primary payload chains: GOLDVEIN.JAVA, a Java variant downloader establishing connections to control servers, and the SAGE infection chain with multiple nested Java payloads.
Based on reporting by Cyber Security News.