Oracle on Thursday said the company is investigating a wave of extortion emails targeting customers of its E-Business Suite. Oracle confirmed the attacks might be related to software vulnerabilities disclosed in July.
As previously reported, hackers claiming to be linked to the Clop ransomware gang have been sending hundreds of emails to corporate executives that use the Oracle product, claiming to have stolen data.
Oracle’s chief security officer, Rob Duhart, said the attacks are potentially related to critical vulnerabilities disclosed by the company in July, according to a blog post from the company on Thursday.
Duhart strongly encouraged Oracle customers to review the July update and patch their systems to make sure they are are protected.
Researchers from Google Threat Intelligence Group on Thursday warned that hackers claiming a Clop affiliation have been sending emails to corporate executives threatening extortion, but did not provide immediate proof that any data had been stolen.
Google and its Mandiant incident response unit track the group under the name FIN11, a group that has strong historic ties to Clop.
The extortion letters provided contact emails where the executives could reply to the demands. Those email addresses tracked with ones previously used by Clop. The threat group is widely known for its role in the 2023 exploitation of vulnerabilities in MOVEit file transfer software. More recently Clop was linked to exploitation of vulnerabilities in Cleo file transfer software, leading to dozens of attacks against retailers and other logistics companies.
Researchers at Kroll told Cybersecurity Dive the hackers have been sending spear-phishing emails to Oracle customers claiming to have access to sensitive ERP data. Kroll tracks Clop under the name KTA080.
“Kroll has seen ransom-demand emails which do match contact emails used in previous KTA080 (Cl0p) ransom demands,” said Max Henderson, global head of digital forensics and incident response at Kroll.
Researchers from Mandiant and Kroll said organizations should take the demands seriously and check their systems for possible data theft and compromise.
