Hackers Demand $50 Million in Mass Extortion Attack Targeting Unpatched Systems

A notorious ransomware gang has launched a digital siege on corporate America, and the bullseye is on one of the world's most critical business platforms: Oracle E-Business Suite (EBS).

Forget vague threats—this is a high-stakes, personalized shakedown. The group, widely linked to the infamous Clop ransomware cartel, is sending direct extortion emails to C-level executives, claiming to have already stolen their most sensitive corporate data. The demand? In one confirmed case, a chilling $50 million.

The most alarming part? Oracle has confirmed the attack and directly links it to known security holes that they patched back in July 2025. This means every company that delayed this critical update is now exposed and actively in the crosshairs.

Attack Blueprint: How the Hackers Are Breaking In

This isn't a sophisticated zero-day mystery. Oracle's Chief Security Officer, Rob Duhart, has publicly stated their investigation points to the "potential use of previously identified vulnerabilities that are addressed in the July 2025 Critical Patch Update."

The keys to the kingdom were left under the mat, and the burglars are now inside.

The July patch fixed a total of 309 vulnerabilities across Oracle's products. But for EBS users, these nine are your nightmare. Three of them are particularly dangerous because attackers can exploit them without needing a username or password.

CVE ID	CVSS Score	Component	Remote Exploit?	Why It's Dangerous
CVE-2025-30746	6.1	Oracle iStore	YES	Public-facing, no login required for attack.
CVE-2025-30745	6.1	MES for Process Manufacturing	YES	Critical supply chain system exposed.
CVE-2025-50107	6.1	Universal Work Queue

Hacker's Playbook is Simple:

Scan for unpatched, internet-facing Oracle EBS systems.
Exploit one of the vulnerabilities above to gain access.
Exfiltrate gigabytes of financial, HR, and operational data.
Extort by emailing the CEO with a multi-million dollar demand and "proof" of the theft.

Trail of Extortion Email

The emails are designed to trigger panic in the boardroom. They don't sound like a typical spammer; they sound like a ruthless business partner.

"We are the CL0P team." They immediately establish their feared brand identity.
"We have copied your company's documents and databases." A direct claim of total compromise.
"We offer you a chance to get out of this situation." Framing the ransom as a "business solution."
"We can provide you with 3-5 files or 50-100 lines from any database as proof." This is the masterstroke that turns fear into certainty, forcing executives to take the threat seriously.

Security firm Mandiant has confirmed the infrastructure and email addresses used in this campaign are directly tied to the FIN11 group, a known affiliate of Clop, famous for its massive attacks on file-transfer tools like MOVEit.

How to Avoid Being the Next Victim

If your company runs Oracle EBS, this is not a drill. Your action plan is straightforward but non-negotiable.

PATCH. NOW. Apply the July 2025 Critical Patch Update (CPU) immediately. This is the single most important action you can take. Delay is an invitation for catastrophe.
Assume You're Breached. Don't wait for the extortion email. Initiate threat hunting in your EBS environment now. Look for unusual logins, large data exports, and any signs of the IOCs linked to this campaign.
Lock Down Access. Immediately review and secure all internet-facing EBS logins. Implement Multi-Factor Authentication (MFA) everywhere possible to stop credential-based attacks.
Train Your Executives. Ensure your C-suite knows these emails are circulating and has a clear protocol to report them directly to security teams—not to panic and pay.

For thousands of organizations, applying a patch from three months ago is the only thing standing between them and a multi-million dollar shakedown. The time for action was yesterday. The next best time is right now.

Hackers Demand $50 Million in Mass Extortion Attack Targeting Unpatched Systems

Related threat feeds

FIFA World Cup Broadcast Infrastructure Exposed Through Broken Authorization Flaw

Attack Blueprint: How the Hackers Are Breaking In

Trail of Extortion Email

How to Avoid Being the Next Victim

Splunk Enterprise Vulnerability Enables Unauthenticated Remote Code Execution

ServiceNow MID Server Authentication Bypass Exploited to Extract Data from 341 Customer Instances