In late September and early October 2025, the cybersecurity world was jolted by reports of a massive extortion campaign sweeping across the United States. Executives at multiple organisations spanning industries and geographies have received threatening emails claiming that cybercriminals have stolen sensitive data from their Oracle E-Business Suite (EBS) systems, demanding payment in return for silence. The attackers brandish the name Cl0p (sometimes stylised “CL0P” or “Clop”), one of the most notorious ransomware groups of recent years, or at least purport affiliation with it. Whether these claims are genuine or bluff, the campaign is causing alarm, forcing many organisations to revisit their security assumptions and response strategies.
In this blog post, we will explore:
- The mechanics and scope of this new campaign
- The history and tactics of the Cl0p group
- The particular risks posed by targeting senior executives
- Suspected vectors, technical methods, and attribution challenges
- Recommended mitigation and response strategies
- Broader implications for cybersecurity resilience
1. Anatomy of the Campaign: What We Know So Far
Mass Extortion Emails to Executives
Beginning around 29 September 2025, a flurry of extortion emails began landing in the inboxes of C-suite executives, IT leadership, and other senior staff. According to Google’s Threat Intelligence Group and Mandiant (its incident response arm), these emails claimed attackers had exfiltrated data from the victims’ internal Oracle E-Business Suite systems.
What makes the campaign noteworthy:
- The volume is high: the emails are being sent from hundreds of compromised accounts across disparate organisations, rather than a single malicious server.
- The attackers include contact email addresses that match those on Cl0p’s public data leak site, lending credence (or at least marketing weight) to their claim.
- Some emails furnish supposed proof of compromise screenshots of directory listings or file trees, or samples of data rows to back up their claims.
- Ransom demands are steep: in some cases, figures up to USD 50 million have been mentioned.
- The language often contains broken English and odd phrasing, a hallmark seen in previous Cl0p (or Cl0p-style) communications.
Yet, crucially, no definitive public confirmation has yet been made that these organisations were breached or that data was exfiltrated in the way the emails claim. Google has stated that it “does not currently have sufficient evidence to definitively assess the veracity of these claims.”
Focus on Oracle E-Business Suite
The common thread in the extortion notes is a claim of compromise in Oracle EBS the enterprise resource planning (ERP) suite used globally for finance, HR, supply chain, and more.
Oracle, for its part, has confirmed being aware of “dangerous emails” sent to EBS customers, and has noted that the attackers “potentially use previously identified vulnerabilities” addressed in the July 2025 Critical Patch Update.
Oracle also emphasised that the incident involves customer-managed (on-premises) systems, not their cloud infrastructure, meaning responsibility for patching and configuration lies with the end users.
Cybereason, a cybersecurity vendor investigating the matter, has suggested that the attackers may have used unpatched instances of Oracle EBS (or weakly configured ones) to gain access, enumerate data, and stage exfiltration.
However, it is unclear whether the attackers exploited new zero-day vulnerabilities, or merely abused known flaws or misconfigurations.
Attribution Ambiguities: Cl0p or Impersonation?
The attackers claim affiliation with Cl0p, and make use of email addresses known from Cl0p’s public data leak site. But attribution is murky:
- Some of the compromised sender accounts have previously shown links to FIN11, a financially motivated threat group that has collaborated or overlapped in operations with Cl0p.
- Researchers caution that threat actors sometimes mimic or impersonate more infamous groups to intensify pressure and legitimacy.
- The technical patterns mass email campaigns, provision of contact addresses, use of compromised accounts, supplying “proofs” of compromise align with past Cl0p behaviour.
All this leads analysts to describe the threat actor as Cl0p-linked or Cl0p-style, rather than definitively Cl0p.
2. The Cl0p Ransomware Group: A Profile
To understand why an extortion campaign invoking Cl0p causes such alarm, it’s useful to review what is known about the group and its modus operandi.
Origins and Evolution
- Cl0p (or Clop) is a Russian-speaking cybercriminal organisation first observed in 2019, evolving from variants of CryptoMix.
- Over time, its business model has gravitated toward “extortion-first” tactics in some cases, foregoing encryption entirely and focusing on threatening data exposure.
- Cl0p is widely known for high-impact data theft, often targeting file transfer or data exchange platforms to reach many victims at once. For example:
- The MOVEit breach in 2023, which affected over 2,700 organisations and exposed personal data across multiple sectors.
- Exploits of vulnerabilities in tools such as Accellion FTA, GoAnywhere, and Cleo in past years.
Through these supply chain or platform attacks, Cl0p has demonstrated that it can gain access to hundreds or thousands of organisations simultaneously, amplifying its leverage.
Tactics, Techniques and Procedures (TTPs)
Some recurring patterns in Cl0p’s approach:
- Supply-chain or third-party exploitation Cl0p seeks vulnerabilities in software widely used file transfer systems, connectors, APIs, shared platforms so it can infiltrate many downstream victims.
- Phishing, credential theft, account compromise They use phishing or infostealers to obtain legitimate credentials, allowing them to send extortion emails from trusted accounts. This also helps bypass spam filters.
- Silent reconnaissance and lateral movement After gaining a beachhead, attackers explore the environment, escalate privileges, search for data of high value (financial, HR, legal, confidential), and prepare exfiltration.
- Data exfiltration followed by extortion Rather than encrypt first, Cl0p often steals data quietly, then threatens to publish or sell it if a ransom is not paid.
- Leverage of “proof of compromise” To coerce victims, they often provide small samples of stolen data, screenshots of internal file structures, or directory listings to show legitimacy of their claim.
- Brand recognition and psychological pressure The use of the Cl0p name, the public data leak site, or known contact addresses helps the attackers capitalise on the fear and reputation that Cl0p has already built.
Because Cl0p has demonstrated success in demanding very large ransoms, even a hint of compromise by them can trigger panic among executives and legal or compliance teams.
3. Why Target Executives?
The decision to target senior executives is deliberate and strategic. The attackers are not merely fishing for low-hanging fruit; they are attacking the levers of influence within an organisation.
Concentration of Pressure and Sense of Crisis
- Executives represent decision makers: if they believe the organisation is compromised, they may approve ransom payment, allocate emergency resources, or override slower risk-based procedures.
- A message directed at an executive tends to generate urgency, fear of reputational damage, board pressure, regulatory scrutiny, and political fallout.
- The attackers hope that executives, anxious for quick resolution, might bypass cautious vetting or lean toward “pay to make it go away.”
Asymmetric Targeting
Rather than attacking every system or endpoint indiscriminately, focusing on executives allows attackers to:
- Amplify the impact with fewer resources
- Leverage “authority bias” – recipients may assume the message is legitimate
- Force a strategic discussion at the highest level, accelerating decision cycles
Psychological Leverage: Fear, Reputation, Exposure
- Threatening public exposure of stolen data or confidential materials can pose existential risks to a company’s reputation and share price.
- Revealing that executives’ emails or internal documents are part of the theft heightens fear of board-level liability or regulatory action (e.g. GDPR, SEC disclosure rules).
- It creates a “scarcity of time” – the deadline for paying increases pressure to act without full investigation.
In short, targeting executives is a psychological and tactical lever to force swift and impactful responses.
4. Suspected Vectors, Technical Methods & Challenges of Verification
Potential Attack Vectors
From what investigators and security vendors have pieced together:
- The attackers may have taken advantage of unpatched or misconfigured Oracle EBS instances, especially those exposed to the internet.
- The July 2025 Critical Patch Update for Oracle included 309 patches across multiple products, including nine for EBS. Some of these patches addressed web-facing vulnerabilities.
- Attackers may exploit default password-reset functions or weaker local accounts that bypass corporate Single Sign-On (SSO) mechanisms.
- The use of compromised accounts in third parties as email senders can obfuscate attribution and bypass email filters.
- Attackers may deploy webshells or backdoors post-intrusion for persistence and further reconnaissance. (While not yet confirmed publicly in this campaign, this is consistent with past Cl0p tactics.)
The Difficulty of Confirming Breach
One of the most intriguing aspects of this campaign is that, despite bold claims of theft, investigators have yet to publicly confirm data exfiltration or authenticated compromise in all (or even many) of the targeted organisations. Reasons include:
- False claims or bluffing: It is not uncommon for extortionists to fabricate claims of theft or reuse publicly available data to pressure victims.
- Fragmented visibility: Organisations may not yet have detected intrusion, or the attackers may have covered their tracks well, leaving weak forensic evidence.
- Attribution obfuscation: Attackers can route traffic through anonymisation networks, use compromised infrastructure, or spoof addresses to mask appearances.
- Mimicry: Some criminal actors may impersonate Cl0p (or reuse its branding) to benefit from its reputation, without actually being part of the Cl0p organisation.
Therefore, even though many in the security community lean toward believing there is substance behind some of the claims, definitive proof in all cases remains elusive.
5. Mitigation, Response and Best Practices
Given the high stakes, what steps should organisations especially those running Oracle EBS or similar enterprise suites take immediately and over the medium term?
Immediate Steps (Incident Response)
- Treat all claims as credible until disproven Even if the attacker’s claim is a bluff, it must be responded to with due seriousness. Escalate internally, engage legal, PR, and cybersecurity teams.
- Search for signs of intrusion Conduct forensic checks for:
- Unusual accounts or logins
- Webshells or suspicious files in web directories
- Abnormal outbound connections or data flows
- Logs showing directory enumerations, access to sensitive modules
- Check whether your environment was targeted Search email logs, quarantine filters, spam filters for traces of the extortion messages. Review whether any of the contact addresses or subject lines appear.
- Isolate and contain Step up monitoring, segment network domains, restrict access to critical ERP components, force credential rotations.
- Communicate carefully
- Engage external legal and regulatory advisors
- Prepare public disclosures if data exposure is likely
- Maintain internal transparency at board or executive level
- Don’t rush to pay Paying ransom is not a guarantee, and may encourage repeat attacks. Consider alternatives mitigation, negotiation, or even exposing bluff attempts. But each situation must be judged on its merits.
Short-to-Medium Term Defences
- Patch promptly and aggressively Ensure all systems are up to date. Oracle customers are advised to immediately apply the July 2025 Critical Patch Update, particularly for EBS systems.
- Harden configurations
- Disable unused or weak local login accounts
- Ensure password resets or default accounts are secured or disabled
- Require multi-factor authentication (MFA), particularly for administrator access
- Apply principle of least privilege
- Network-level defences and segmentation Use web application firewalls (WAFs), intrusion detection/prevention systems, anomaly-based monitoring. Segregate ERP environments so lateral movement is harder.
- Logging, detection, and oversight Enable detailed audit trails, monitor for file access anomalies, outbound data spikes, and internal scanning tools. Use SIEM (Security Information and Event Management) systems to alert on suspicious patterns.
- Tabletop exercises & response packs Prepare playbooks for executive extortion, public relations fallout, legal obligations (e.g. regulatory reporting), and negotiation strategies.
- Cyber insurance and third-party readiness Confirm coverage for extortion, legal exposure, and forensic response. Ensure relationships with external incident response firms are in place before a crisis.
- Executive awareness and training Ensure leaders know of this threat vector don’t assume only IT is targeted. Simulated phishing for executives, communication protocols, and decision frameworks should be rehearsed.
6. Broader Implications & Lessons Learned
This campaign regardless of its absolute success ushers in several worrying shifts in the ransomware and extortion landscape:
Extortion Without Encryption Becomes More Common
More criminal actors appear to rely purely on data theft and threat of exposure, rather than deploying file encryption. This lowers their technical footprint but retains leverage. Cl0p has been one of the leading adopters of this “encryption-less” model.
Supply Chain & Shared Platform Risk Intensifies
Attacks via third-party platforms or enterprise suites magnify the blast radius. When software used by multiple organisations is compromised, many victims can be impacted simultaneously.
Reputation & Legal Exposure as Attack Surfaces
In targeting executives, the attacker is also weaponising reputational risk, regulatory exposure, and board-level pressure not merely technical vulnerabilities. Organisations must be ready for legal, compliance, and public scrutiny.
Attribution Blurring & Impersonation Risk
Attribution is always messy in cybercrime. But campaigns like this that invoke notorious names (Cl0p, FIN11) can increase confusion and manipulation. Organisations must not simply assume a known brand means a certain actor; technical validation is essential.
Shifting the Decision to the Top
By targeting senior roles, attackers aim to force fast decisions, sometimes before thorough investigation can be completed. Organisations must build advance protocols so that emergency decisions don’t bypass proper checks.
Conclusion
The Cl0p-style extortion campaign targeting U.S. executives is a stark warning: ransomware and data-theft actors are becoming more sociopolitical, psychological, and bold. They are no longer content with bulk encryption of endpoints; they want to reach into the boardroom, offering a clean narrative: “We have stolen your secrets. Pay us, or watch them go public.”
Whether or not all the claims tied to this campaign turn out to be real, this wave of attacks imposes real costs: fear, distraction, internal turmoil, and potential exposure. In a world where reputations and regulatory scrutiny matter as much as technical control, organisations cannot merely treat such emails as spam they must be taken as potential harbingers of existential risk.
For those responsible for securing enterprise systems, especially critical ERP systems like Oracle EBS, the take-aways are urgent:
- Assume you may be targeted, even if your perimeter seems secure
- Prioritise patching, hardening, segmentation, and detection
- Prepare executive escalation paths and integrated response plans
- Cultivate external relationships (IR firms, legal, PR) in advance
- Train leadership to act thoughtfully under pressure not panicked
In the face of an ecosystem where cyber extortion can scale rapidly and exploit fear as much as code, resilience is not optional. Vigilance, preparation, and coordination across technical, legal, and executive domains are the best defence.
References
- Reuters – Google says hackers are sending extortion emails to executives
- Reuters – Oracle says hackers are trying to extort its customers
- CyberScoop – Extortion email campaign claims Cl0p hacked Oracle customers
- Cybersecurity Dive – Hackers impersonate Cl0p in massive extortion campaign
- CSO Online – Cl0p-linked threat actors target Oracle E-Business Suite in extortion campaign
- Cybereason – Oracle EBS extortion campaign tied to Cl0p tactics
- Bank Info Security – Extortionists claim mass Oracle E-Business Suite data theft
- Help Net Security – Oracle EBS data theft extortion campaign warning
- Wikipedia – Clop (cyber gang)
- Wikipedia – 2023 MOVEit data breach
- New York Post – Multiple US executives targeted by ransomware in high-volume attack, Google warns