Extortionists Claim Mass Oracle E-Business Suite Data Theft

Digital extortionists are shaking down executives at organizations that use Oracle E-Business Suite, claiming to have stolen their sensitive data, warn multiple cybersecurity firms.

See Also: Why Cyberattackers Love ‘Living Off the Land’

Google said its Mandiant incident response group is probing the “high-volume email campaign” by a group that claims to be affiliated with the Clop – aka Cl0p – ransomware operation. The emails, sent to many different organizations, claim attackers stole data from their Oracle enterprise applications.

Oracle didn’t immediately respond to a request for comment.

Oracle E-Business Suite comprises everything from enterprise resource planning and customer relationship management, to human resources and supply chain management software.

Cybersecurity firm Halcyon said it’s also responding to this campaign and that the attackers appear to have wielded stolen user credentials together with a password-reset feature in internet-facing E-Business Suites to gain access to victims’ portals.

“We have seen Cl0p demand huge seven and eight-figure ransoms in the last few days,” including in one case a $50 million shakedown, Cynthia Kaiser, vice president at Halcyon’s ransomware research center, told Bloomberg.

The extortion aspect of this campaign appeared to begin on or before Monday, said Genevieve Stark, head of cybercrime and information operations intelligence analysis for Google’s threat intelligence group, which tracks the Russian-speaking, financially motivated Clop group as FIN11 and formerly as UNC4857.

Despite the attacker’s assertions, including a supposed connection with Clop, she said Mandiant investigators “have not yet substantiated the claims made by this group.”

Already numerous organizations have received emails being sent from hundreds of compromised email accounts, of which two have been used in previous campaigns attributed to Clop, said Mandiant CTO Charles Carmakal.

“The malicious emails contain contact information, and we’ve verified that the two specific contact addresses provided are also publicly listed on the Clop data-leak site,” he said. “This move strongly suggests there’s some association with Clop and they are leveraging the brand recognition for their current operation.”

Canadian cybersecurity firm Cypfer likewise has seen seeing multiple Oracle EBS-using organizations being targeted by extortionists. “If you are managing this application for your organization, our advice is to ensure the environment is patched to the latest patches, full auditing/logging is enabled and monitoring is in place,” said Ed Dubrovsky, Cypfer’s chief operating officer, in a LinkedIn post.

Making accurate attributions can be challenging given how cybercriminals have a history of over-inflating their prowess, as well as stating outright lies. Many criminals regularly repackage previously stolen or publicly leaked data and claim to have perpetrated a fresh breach. Others claim to have stolen data – but didn’t – or steal data that turns out to be anything but sensitive.

“Attribution in the financially motivated cybercrime space is often complex, and actors frequently mimic established groups like Clop to increase leverage and pressure on victims,” Carmakal said.

The attacker’s claims should be treated with caution and investigators have yet to gather sufficient evidence to prove or deny the assertions. But he recommended that targeted organizations immediately “investigate their environments for evidence of threat actor activity.”

Supply-Chain Attack Specialist

Attacks attributed to the Clop operation first began in 2019, and used a variant of previously seen ransomware called CryptoMix.

Since then, the group’s hallmark has been finding and exploiting previously unknown flaws in managed file-transfer software, rapidly stealing data from a huge swath of users, then holding them to ransom.

It targeted users of Accellion FTA from late 2020 to early 2021 and GoAnywhere Managed File Transfer software in early 2023, compromising over 100 organizations. Over Memorial Day in 2023, Clop hit Progress Software’s MOVEit, amassing over 2,700 victims. In late 2024, it hit Cleo Communications’ Harmony, VLTrader and LexiCom MFT software, leading to more than 380 known victims.

Stealing data from many different victims but not deploying ransomware gives attackers a way to monetize their efforts without bothering with crypto-locking malware. In the MOVEit attacks, experts estimated the group earned $75 million to $100 million from victims who paid for a promise that they wouldn’t be named, or their stolen data leaked.

Extortion Demands Not Always Immediate

In previous Clop campaigns, the group began sending extortion emails to victims sometimes days or weeks after the actual attack, potentially “to extend the amount of time that the zero-day vulnerabilities remained undetected and thus increasing the number of victims and/or capacity to negotiate with a large number of victims simultaneously,” Google said in a 2023 investigation into FIN11.

The group regularly lists non-paying victims on its data-leak site. In the case of Cleo Communications, the group drip-fed details about the identities of its supposed victims, in some cases not naming them for weeks or months after the attack. Security experts said the delay might have reflected the group waiting to see the results of its extortion efforts with individual victims as well as attempting to maximize the notoriety of its activities and public pressure on victims (see: Vampire Cosplay and Brand Revival: Ransomware in 2025).

Clop’s repeat ability to discover and exploit zero-day vulnerabilities in widely used managed file-transfer software suggests the group plows a notable portion of its ransom revenue into offensive research and development efforts.