Recent cyberattacks targeting corporate executives through extortion emails may have resulted in significant data theft from numerous organizations. The CL0P extortion gang reportedly infiltrated Oracle’s e-Business software to steal large amounts of data. Despite Oracle’s initial claims that vulnerabilities patched in July were the source, emergency patches were later issued, highlighting the severity of the issue. The Google Threat Intelligence Group revealed that the attacks began as early as September 29, with suspicious activity dating back to July.
The extortion campaign followed months of intrusions into Oracle environments, possibly exploiting a zero-day vulnerability before the patch was released. Data exfiltration likely occurred before the extortion attempts, with significant amounts of data stolen from affected organizations.
Oracle’s software, crucial for managing customer data and employee information, was repeatedly exploited to steal personal data from corporate executives. The zero-day vulnerability, identified as CVE-2025-61882, allowed attackers to execute remote code, with the attacks linked to a Russia-based group known as Graceful Spider.
This method of exploiting zero-day vulnerabilities, followed by extortion campaigns, is a known strategy of the group FIN11, increasing the efficiency of data theft operations. The approach minimizes the attackers’ network footprint and delays detection, enhancing the impact. The CL0P group is expected to continue acquiring zero-day exploits for similar attacks in the future.
