Google has issued a warning after hackers claiming to be part of the Clop ransomware gang allegedly stole sensitive data from Oracle E-Business Suite and sent extortion emails to company executives.
What Happened?
According to reports, the cyberattack began around September 29, when attackers launched a large-scale email campaign using hundreds of hacked third-party accounts. Some ransom demands were reportedly as high as $50 million.
How Did Hackers Gain Access?
Cybersecurity firm Halcyon revealed that the attackers gained access by:
- Stealing valid user credentials through email phishing.
- Exploiting Oracle’s default password reset option.
This allowed them to target Oracle E-Business Suite, which manages critical business operations such as financial systems, supply chain management, and customer relationship management.
Google’s Response
Google said it does not yet have enough evidence to confirm the hackers’ claims but is actively monitoring the situation.
Background on Clop Ransomware
The Clop ransomware group is known for high-profile attacks. In 2023, the gang exploited MOVEit software vulnerabilities and targeted major companies including Shell, British Airways, and BBC.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has identified Clop as one of the world’s largest phishing distributors, impacting more than 8,000 organizations globally, including 3,000 U.S. enterprises.
Why This Matters
Oracle E-Business Suite is widely used by global companies for day-to-day operations. A successful ransomware attack could disrupt financial transactions, supply chain processes, and customer data management. Businesses using Oracle systems should immediately review their cybersecurity practices, update passwords, and monitor suspicious activity.
Key Takeaways
- Clop ransomware gang allegedly targeting Oracle E-Business Suite.
- Extortion emails sent with ransom demands up to $50 million.
- Hackers gained access through stolen credentials and default reset features.
- Google warns but says evidence remains limited.
- CISA lists Clop among the biggest global phishing threats.
Stay updated on the latest cybersecurity threats and take proactive steps to protect your organization.
