Oct 4, 2025

Updated

• Closed✓Patched

  Cl0p extortion campaign via Oracle E-Business Suite zero-day (CVE-2025-61882)

  Cl0p-branded extortion emails reached executives from September 29, 2025, claiming theft of Oracle E-Business Suite data. Mandiant tied the campaign to exploitation of an unauthenticated RCE in EBS (SyncServlet), patched as CVE-2025-61882 for EBS 12.2.3 to 12.2.14. A separate July UiServlet SSRF campaign was later tracked as CVE-2025-61884.

  Oracle E-Business Suite·Closed Oct 20, 2025·updated Oct 20, 2025