The IT Nerd

The Washington Post has now joined the growing list of companies hacked via the apparent security issues with the Oracle E-Business Suite:

In a statement released on Thursday, the newspaper said it was one of those impacted “by the breach of the Oracle E-Business Suite platform.”

The paper did not provide further detail, but its statement comes after CL0P, the notorious ransomware group, said on its website that the Washington Post was among its victims. CL0P did not return messages seeking comment. Oracle pointed Reuters to a pair of security advisories issued last month.

Lidia Lopez, Senior Threat Intelligence Analyst at Outpost24 had this to say:

“The Oracle E-Business Suite exploitation confirms Cl0p’s continued shift from opportunistic ransomware to large-scale, coordinated data-theft operations targeting core business platforms. This is not an isolated case but part of a recurring pattern in which Cl0p identifies or acquires zero-day vulnerabilities in enterprise software, such as MOVEit, GoAnywhere, and now Oracle EBS, to compromise hundreds of organizations in a single, synchronized campaign. Strategically, it highlights how financially motivated actors are now pursuing the same mission-critical systems once primarily targeted by state-sponsored espionage.

Cl0p is a sophisticated ransomware and data-extortion group that often exploits zero-day or high-severity vulnerabilities in widely used enterprise software, such as managed file transfer platforms (MOVEit, GoAnywhere, Cleo) and business applications like Oracle E-Business Suite, to compromise multiple organizations simultaneously. They scan networks to identify vulnerable systems, gain initial access, establish persistence, move laterally, and quietly exfiltrate large volumes of sensitive data.

In recent campaigns, Cl0p has increasingly focused on data theft and extortion rather than encryption, threatening to publish stolen information on their Data Leak Site (DLS) to pressure victims into payment.

Unlike ransomware gangs that depend on large affiliate networks under Ransomware-as-a-Service (RaaS) models to conduct opportunistic attacks, Cl0p’s operations are centrally coordinated and technically sophisticated. This structure enables them to conduct large-scale, synchronized intrusion campaigns that exploit critical vulnerabilities before they are publicly disclosed or patched.”

Faik Emre Derin, Technical Content Manager at SOCRadar adds this comment: 

“The Oracle EBS breach affecting The Washington Post represents a continuation of systematic targeting of enterprise systems through CVE-2025-61882, a critical zero-day vulnerability with a CVSS score of 9.8. According to our threat intelligence data, this campaign has impacted dozens to over a hundred organizations globally since exploitation began in August 2025, well before Oracle’s emergency patch release on October 4.

What makes this campaign particularly concerning is the convergence of multiple threat actors. While Cl0p and FIN11 are conducting the primary extortion operations, our analysis indicates that the exploit was subsequently leaked by a separate collective called “Scattered Lapsus$ Hunters” on October 3, creating a broader threat landscape. The availability of public proof-of-concept exploits has significantly expanded the attack surface beyond the initial targeted campaign.

The vulnerability affects Oracle EBS versions 12.2.3 through 12.2.14, specifically targeting the BI Publisher Integration component within the Concurrent Processing module. This component’s unauthenticated remote code execution capability allows attackers to compromise systems without credentials, making internet-facing EBS deployments particularly vulnerable.

Organizations running Oracle EBS should prioritize several critical actions:

• Immediate patching (ensuring the October 2023 CPU prerequisite is installed first)
• Retroactive threat hunting dating back to August 2025
• Examination of specific indicators of compromise including connections to IP addresses 200.107.207.26 and 185.181.60.11

Given the sophisticated nature of this campaign and the involvement of multiple financially motivated threat groups, we recommend organizations assume breach and conduct thorough forensic analysis even after patching.

The inclusion of prominent organizations like The Washington Post, Harvard University, and Schneider Electric in the victim list underscores that this is not an opportunistic attack but a calculated campaign targeting high-value enterprise data. The threat actors’ demonstrated ability to maintain persistent access for months before detection emphasizes the critical need for continuous monitoring and proactive threat hunting in enterprise environments.”

This is going to be this year’s MoveIT hack. That one was pretty bad. This is increasingly getting worse. And we’re not at the bottom of this yet. Which is bad for everyone.