Tag: CVE-2025-61882

4 Attack Reports | 1 Vulnerabilities

Attack reports

CLOP RANSOMWARE: DISSECTING NETWORK - THE RAVEN FILE

The report analyzes the network infrastructure used by the Clop ransomware group, focusing on their exploitation of CVE-2025-61882 in Oracle EBS. It identifies 96 IP addresses associated with a specific fingerprint, with Germany, Brazil, and Panama being prominent locations. The analysis reveals si…
ransomware
CVE-2023-0669
cyclops blink
infrastructure
CVE-2023-34362
CVE-2025-61882
2025-11-05
cryptomix
oracle ebs
fingerprints
ip addresses
network analysis
Published: November 5, 2025
Downloadable IOCs: 203

Oracle E-Business Suite Zero-Day Exploited in Widespread Extortion Campaign

A large-scale extortion campaign targeting Oracle E-Business Suite (EBS) customers began on September 29, 2025. The threat actor, claiming affiliation with the CL0P extortion brand, exploited a zero-day vulnerability (CVE-2025-61882) in EBS as early as August 9, 2025. The campaign involved sending …
CVE-2025-61882
oracle e-business suite
2025-10-09
goldvein.java
sagegift
sagewave
goldvein
Published: October 9, 2025
Downloadable IOCs: 0

Oracle E-Business Suite CVE-2025-61882 - Malware Analysis

A critical vulnerability in Oracle E-Business Suite (CVE-2025-61882) is being actively exploited. The attack involves dropping malicious template files through a Python script, which are then activated by previewing. Two types of templates are used: one contacting a hardcoded IP address to execute …
backdoor
template injection
weblogic
CVE-2025-61882
oracle e-business suite
2025-10-08
java exploitation
arbitrary code execution
Published: October 8, 2025
Linked vulnerabilities : CVE-2025-61882 (CVSS 9.8)
Downloadable IOCs: 9

Oracle Security Alert Advisory - CVE-2025-61882

A critical security vulnerability (CVE-2025-61882) has been identified in Oracle E-Business Suite versions 12.2.3-12.2.14. This flaw is remotely exploitable without authentication, potentially leading to remote code execution. The vulnerability affects the BI Publisher Integration component of Orac…
remote code execution
CVE-2025-61882
2025-10-06
security alert
oracle e-business suite
Published: October 6, 2025
Linked vulnerabilities : CVE-2025-61882 (CVSS 9.8)
Downloadable IOCs: 5
Click here to see more Attack Reports

Vulnerabilities

CVE-2025-61882

9.8
    Oracle
  • Concurrent Processing
Published: October 5, 2025
Click here to see more Vulnerabilities