A wave of sophisticated cyberattacks is targeting organizations running Oracle E-Business Suite (EBS). The Cl0p ransomware group, known for high-impact extortion campaigns, has exploited existing and newly discovered vulnerabilities to steal sensitive data from dozens of organizations — including The Washington Post, Harvard University, Envoy Air and major industrial firms like Schneider Electric and Emerson. The attacks have resulted in the exposure of personal, financial and operational data, with ransom demands and threats of public data leaks.[1]
What is Cl0p?
Clop (also written as Cl0p or cl0p) is a type of ransomware that encrypts victims’ files and appends the .clop extension to them. A distinctive feature of Clop is the phrase “Don’t Worry C|0P,” which is included in its ransom notes. While Clop is a variant of CryptoMix ransomware, it possesses additional capabilities. Clop was first identified by security researchers in February 2019 following a large spear-phishing attack. It remains a significant cybersecurity threat to organizations of all sizes, as it corrupts files and demands ransom payments.[2] Several sites, including RansomLook,[3] monitor Cl0p’s activity and defining attributes.
Development of the latest Cl0p attack on Oracle EBS
- On October 2nd, based on threat intelligence from Google Threat Intelligence Group (GTIG)/Mandiant[4], Halcyon[5] and other sources[6], Rimini Protect™ security services began tracking information that threat actors were actively exploiting previously known vulnerabilities in Oracle EBS.
- These sources revealed that multiple organizations had received extortion emails from the Cl0p ransomware group, claiming they had stolen sensitive data from Oracle EBS deployments and instructing executives to contact an email address to receive evidence of the breach and payment instructions.[7] Within one day, the Rimini Protect™ team distributed its initial Zero-Day Advisory to clients.
- Oracle acknowledged the threat and, on October 4th, announced a new vulnerability in E-Business Suite (CVE-2025-61882).[8] Two days later, CISA included this vulnerability in its Known Exploited Vulnerabilities Catalog (KEV).[9]
- Then, on October 11th, Oracle identified and resolved another E-Business Suite vulnerability (CVE-2025-61884) through an out-of-band update which was added to the KEV on October 20.[10]
- As of November 13th, 2025, organizations continue to experience system compromises due to vulnerabilities in Oracle EBS. Incident of Compromise (IOC) reports and public threat intelligence highlight the recent use of a malicious script named server.py which listens for connections for compromised servers and acts as a command-and-control (C2) server to receive stolen data or send attacker commands.[11]
- On November 13th, 2025 Rimini Street released an updated Security Vulnerability Analysis Report (SVAR) to proactively provide clients with the latest security guidance and advanced solutions, helping them to reduce their exposure to ransomware threats.
Identifying and addressing the evolving threat
Cl0p’s hacking campaign is particularly challenging to defend against because it employs multiple attack methods rather than relying on a single vulnerability. In addition to providing ongoing security guidance in updated SVARs, we also provide advanced solutions to help mitigate these evolving threats. The typical sequence of these attacks includes:[12]
- Initial Access: Attackers may gain entry by exploiting software vulnerabilities or through social engineering tactics.
- Lateral Movement: Once inside, attackers explore the ecosystem to identify valuable targets.
- Data Exfiltration: Sensitive data is stolen or transferred off-site for ransom purposes.
- Ransom Demand: Victims discover the breach when attackers leave files on compromised servers.
- Extortion: Attackers threaten to publicly leak stolen data if their ransom demands are not met.
Once attackers infiltrate ERP systems like Oracle EBS, they obtain privileged access to core business records and workflows which are quickly stolen before the breach is detected.
Rimini Street has analyzed a recently published proof of concept (PoC)[13] for one of these vulnerabilities demonstrating how attackers can exploit the Oracle EBS vulnerability via CVE-2025-61882.
Our analysis revealed that successfully exploiting this vulnerability requires coordinating five separate weaknesses within the system. For a detailed breakdown of these steps, please refer to the Security Vulnerability Analysis Report (SVAR) published on November 13, 2025 (initial version distributed to clients on October 3rd, 2025).
It’s important to keep in mind that this is only one of many vulnerabilities that Cl0p is using in its attacks, thus making this attacker group difficult to defend against.
Staying one step ahead
In July 2025, Rimini Street released a Security Vulnerability Analysis Report (SVAR) that proactively identified and provided mitigations for vulnerabilities in Oracle EBS — several of which are believed to be involved in CI0p’s exploitation tactics. This early guidance enabled our clients to harden their environments before the threat became widespread, and also provided assurances to clients leveraging our Rimini Protect™ services and solutions that the threat was properly mitigated.
Following the emergence of CI0p’s campaign, we distributed multiple updated SVARs with threat intelligence containing mitigation options for the vulnerabilities known to date to 1,816 contacts across more than 300 Oracle EBS clients, offering updated hardening strategies, threat indicators and configuration recommendations as new information has emerged.
As the attack pattern evolved — from opportunistic exploitation to coordinated lateral movement and executive-level extortion — the additional SVARs help our clients remain protected with the latest threat intelligence as applied to our mitigations and enhanced hardening guidance.
Advanced security with Rimini Protect™
Rimini Street takes a strategic and proactive approach to risk-based vulnerability management for clients leveraging our Rimini Protect™ services, tailoring solutions to each client’s unique environment to help reduce exposure to security risks. We offer several options to mitigate the threats currently posed by the Cl0p group.
- Leverage Advanced Application and Middleware Security (AAMS): AAMS clients are protected against currently known exploits. Ensure AAMS is correctly configured, with CSRF, File Write, File Exec and Network Traversal rules enabled and set to Protect mode. This helps safeguard against known exploits.
- Leverage Advanced Database Security Suite (ADSS): When configured according to Rimini Street guidance, Rimini Protect™ ADSS monitors database activity providing alerts for suspicious activity and preventing data from being exfiltrated via the tactics currently used by the Cl0p threat group.
- Follow Mitigation Guidance in SVARs: Refer to the Security Vulnerability Analysis Reports (SVARs) for mitigation strategies covering additional vulnerabilities that may be used by Cl0p, including CVE-2025-61882, CVE-2025-30746, CVE-2025-30745, CVE-2025-50107, CVE-2025-21587, CVE-2025-39428, and CVE-2025-21500.
Stay Informed: As attack methods continue to evolve, Rimini Street will continue to publish updated vulnerability guidance to help clients remain protected. For this campaign, Rimini Street has released three Security Vulnerability Analysis Reports (SVARs) so far.
Future Readiness: Staying protected against evolving threats
As threat groups like Cl0p continue to evolve their tactics, organizations running core ERP systems including Oracle EBS need continuous proactive visibility, protection and a strategic security partner. Rimini Protect™ delivers that stability through advanced hardening, proactive SVAR updates and threat-intelligence mitigation guidance, we help clients stay protected long before an exploit becomes widespread.
By combining deep application and database expertise with actionable security intelligence, Rimini Street supports clients in strengthening their environments against today’s complex attack tactics and prepares them for tomorrow’s challenging threats.
