Oracle E-Business Suite Exploitation 2025: How Cl0p Used a Zero-Day and Stolen Mailboxes to Extort Oracle Customers

In late September 2025, executives at organisations running Oracle E-Business Suite (EBS) began receiving emails from the "CL0P team" claiming their EBS applications had been breached and documents copied. The claims were real. Google Threat Intelligence Group and Mandiant later reported that the attackers had exploited what may be CVE-2025-61882, an unauthenticated remote code execution flaw in EBS, as a zero-day from as early as 9 August 2025. Oracle released an emergency patch on 4 October 2025. Harvard University, Envoy Air, The Washington Post and Logitech were among the organisations that later confirmed data theft. This is primarily a software vulnerability campaign, but identity runs through it: an authentication bypass in the exploit chain, commands run as the EBS application's own operating system account, and extortion emails sent from hundreds, if not thousands, of hijacked email accounts.

At a glance

What happened

On 2 October 2025, Oracle's Chief Security Officer Rob Duhart said: "Oracle is aware that some Oracle E-Business Suite (EBS) customers have received extortion emails." BleepingComputer reported that the emails began "We are CL0P team" and claimed the gang had "breached your Oracle E-Business Suite application and copied a lot of documents." Oracle's first guidance pointed to vulnerabilities fixed in its July 2025 Critical Patch Update. Tenable notes that this reference was later removed and replaced with the new zero-day.

On 3 October, a Telegram channel linked to ShinyHunters and Scattered Spider leaked an exploit for Oracle EBS, according to CrowdStrike and BleepingComputer. On Saturday 4 October, Oracle published a security alert for CVE-2025-61882, a flaw that "may result in remote code execution" and is "remotely exploitable without authentication". On 6 October, CISA added it to the Known Exploited Vulnerabilities catalogue and flagged its use in a ransomware campaign, according to Rapid7.

Google Threat Intelligence Group and Mandiant published their analysis on 9 October. They describe the leaked exploit as combining server-side request forgery, CRLF injection, authentication bypass and XSL template injection. CrowdStrike says the activity begins with a POST request to /OA_HTML/SyncServlet, which "initiates the authentication-bypass portion of a multi-step exploit chain", then uses the XML Publisher Template Manager to upload and run a malicious XSLT template. GTIG found malicious templates stored in the EBS database tables XDO_TEMPLATES_B and XDO_LOBS, and in-memory Java malware it tracks as GOLDVEIN.JAVA and the SAGEGIFT, SAGELEAF and SAGEWAVE chain. After exploitation, GTIG observed reconnaissance commands "from the EBS account 'applmgr'", including an attempt to open a reverse shell.

The extortion emails were an identity operation of their own. GTIG says that starting 29 September 2025 the actor sent a high-volume campaign "from hundreds, if not thousands, of compromised third-party accounts", adding that the credentials, belonging to diverse, unrelated organisations, "were likely sourced from infostealer malware logs sold on underground forums." GTIG said file listings provided as proof contained data dating back to mid-August 2025.

Oracle issued a further out-of-band fix on 11 October for CVE-2025-61884, an unauthenticated server-side request forgery flaw that CISA later confirmed was also exploited. By 10 November 2025, SecurityWeek counted 29 organisations named on Cl0p's leak site. Confirmed victims include Harvard University, Wits University in South Africa, Envoy Air and The Washington Post. The Record reported that nearly 10,000 people had information stolen at The Washington Post. Logitech told the SEC in November 2025 that attackers exploited "a bug in a third-party software platform and copied certain data from the internal IT system", without confirming Cl0p's involvement.

Timeline

How it happened: the identity attack path

1. An internet-facing business system. EBS holds finance, HR and supply chain data. Instances reachable from the internet exposed the vulnerable servlets directly.
2. Authentication bypassed, not stolen. The exploit chain included an authentication bypass, so the attackers did not need any EBS user's password. CrowdStrike notes that on at least one confirmed occasion the bypass was related to an administrative account within EBS.
3. Code planted in the application's own data. Malicious templates were written into EBS database tables and then executed by the application, so the payload ran with the application's authority.
4. The application's service account does the work. Reconnaissance and a reverse shell attempt ran as "applmgr", the EBS operating system account. Anything that account could read or reach was in scope.
5. Stolen mailboxes deliver the extortion. Credentials harvested by infostealer malware gave the actor hundreds or thousands of real email accounts at unrelated organisations to send demands to executives, making the campaign harder to block.

Impact

• Organisations: 29 alleged victims named on Cl0p's leak site by 10 November 2025 (SecurityWeek); most had not confirmed a breach at that point.
• Confirmed victims: Harvard University, Wits University, Envoy Air, The Washington Post (nearly 10,000 people, per The Record) and Logitech.
• Data: business data from EBS environments; Logitech said no sensitive personal information, such as national ID numbers or credit card information, was held in the affected system.
• Response burden: two emergency Oracle patches within a week and CISA deadlines for federal agencies.

What this means for NHI governance

The Oracle EBS campaign was driven by a vulnerability, not by a leaked key. It is still an identity story, in two ways that are easy to overlook.

First, the application's own identity. Once the attackers had code running, it ran as the EBS operating system account and with the application's access to its database. Enterprise applications like EBS often run under long-lived service accounts with broad file system, database and network reach, and they sit on servers that can freely call out to the internet. GTIG's recommendation to restrict outbound internet access from EBS servers is, in identity terms, about limiting what a compromised workload identity can do. Our Cloud Workload Identity Guide and Privileged Access Management Guide cover scoping these accounts.

Second, the extortion infrastructure was built from other organisations' stolen identities. Infostealer logs turned into a fleet of legitimate mailboxes. That is the same credential market that feeds attacks on API keys, session tokens and cloud credentials, and it means your own users' and suppliers' accounts may be working for an attacker without any breach of your systems.

Cl0p has used this model before: mass exploitation of a file transfer or business application, bulk data theft and extortion weeks later. Each round shows that the systems holding the most sensitive business data are often the ones with the least visibility into what their service accounts do.

Recommendations

• Patch and reduce exposure. Apply the fixes for CVE-2025-61882 and CVE-2025-61884 and keep EBS off the public internet where possible.
• Hunt for planted templates. Follow GTIG's guidance to review XDO_TEMPLATES_B and XDO_LOBS for suspicious templates, and review web logs for requests to the affected endpoints.
• Restrict what the application account can reach. Block non-essential outbound traffic from EBS servers and limit the "applmgr" account's access to what the application needs.
• Monitor service account behaviour. Interactive shells, reconnaissance commands or new outbound connections from an application account should alert immediately. Our NHI Lifecycle Management Guide covers ownership and monitoring.
• Treat infostealer exposure as an identity risk. Monitor for your domains in infostealer logs, reset exposed credentials and revoke sessions, and brief executives that extortion emails may come from real, compromised accounts.

Frequently asked questions

What is CVE-2025-61882?

It is a critical flaw in Oracle E-Business Suite versions 12.2.3 to 12.2.14, rated CVSS 9.8, that allows unauthenticated remote code execution. Oracle patched it on 4 October 2025 after it had been exploited as a zero-day.

Who was behind the Oracle EBS attacks?

The campaign used the CL0P extortion brand. GTIG has not formally attributed it but notes links to FIN11, and CrowdStrike assesses with moderate confidence that GRACEFUL SPIDER is likely involved. Both say other actors may also have exploited the flaw.

Where is the identity angle in a zero-day campaign?

The exploit bypassed EBS authentication, commands then ran as the application's service account "applmgr", and extortion emails were sent from mailboxes hijacked with infostealer-harvested credentials.

Related NHI Mgmt Group resources

The 52 NHI Breaches Report · Snowflake breach · Gladinet hard-coded keys RCE exploitation · ASP.NET machine keys RCE attack · Top 10 NHI Issues

How NHI Mgmt Group can help

Securing Non-Human Identities (NHIs), including the service accounts that run business applications, is becoming increasingly crucial as attackers turn application compromises into data theft. Our NHI Foundation Level Training Course gives teams the practical grounding to find, govern and protect these identities.

References

• Oracle: Oracle Security Alert Advisory, CVE-2025-61882 (4 October 2025, revised 6 October 2025)
• Google Threat Intelligence Group and Mandiant: Oracle E-Business Suite Zero-Day Exploited in Widespread Extortion Campaign (9 October 2025)
• CrowdStrike: CrowdStrike Identifies Campaign Targeting Oracle E-Business Suite via Zero-Day Vulnerability Tracked as CVE-2025-61882 (6 October 2025)
• BleepingComputer: Oracle links Clop extortion attacks to July 2025 vulnerabilities (3 October 2025)
• Tenable: CVE-2025-61882 FAQ, Oracle E-Business Suite zero-day, Cl0p and July 2025 CPU (October 2025)
• Rapid7: CVE-2025-61882, Critical 0day in Oracle E-Business Suite exploited in-the-wild (October 2025)
• BleepingComputer: CISA confirms hackers exploited Oracle E-Business Suite SSRF flaw (21 October 2025)
• SecurityWeek: Nearly 30 Alleged Victims of Oracle EBS Hack Named on Cl0p Ransomware Site (10 November 2025)
• The Record: Logitech discloses data breach after Clop claims (17 November 2025)