CONFIRMEDDate confidence: CONFIRMEDStated as firmHow firmly the source words the date: confirmed, scheduled, estimated, delayed or unverified.Show all CONFIRMED pins87% CONFIDENCEOverall confidence: 87%How well the pin's source and references back up its dates.Weighted average of how firmly 4 references, the source included, support the pin's start and end times; a reference counts half as much for every 180 days older than the newestShow all pins at 75% confidence or better
Google[1] Threat Intelligence Group: 'Beginning Sept. 29, 2025, Google Threat Intelligence Group (GTIG) and Mandiant began tracking a new, large-scale extortion campaign by a threat actor claiming affiliation with the CL0P extortion brand.'- Start
- Sep 29, 202590% CONFIDENCEsource
Cl0p Starts Emailing Executives Claiming Oracle E-Business Suite Data Theft
A group using the Cl0p extortion brand began mass-emailing executives, saying it had stolen data from their companies' Oracle E-Business Suite systems and demanding payment.
- Beginning 29 September 2025, a threat actor claiming the CL0P brand sent a high volume of emails to executives at numerous organizations, alleging it had stolen sensitive data from their Oracle E-Business Suite (EBS) environments[1].
- Mandiant CTO Charles Carmakal said the emails came from hundreds of compromised accounts, at least one previously associated with FIN11; the email read "We are CL0P team... We have recently breached your Oracle E-Business Suite application and copied a lot of documents"[4].
- On 2 October Oracle's chief security officer Rob Duhart said some EBS customers had received extortion emails and that its investigation pointed to vulnerabilities addressed in the July 2025 Critical Patch Update[3].
- Google's analysis found the campaign followed months of intrusions: what may be CVE-2025-61882 was exploited as a zero-day as early as 9 August 2025, with suspicious activity back to 10 July, and some victims lost significant amounts of data[1].
- The Washington Post later said it was contacted by the attacker on 29 September and that personal data of 9,720 current and former employees and contractors was taken between 10 July and 22 August[2].