oracle is having a rough month..

Quick Overview

The video details a complex, multi-stage exploitation chain targeting Oracle E-Business Suite (EBS) using two distinct zero-day vulnerabilities (CVE-2025-61882 and another related to a misconfigured endpoint) to achieve remote code execution and establish a reverse shell, highlighting confusion around IOCs published by different security vendors like Mandiant and CrowdStrike regarding which specific vulnerability was exploited.

Key Points: The primary attack vector involves exploiting CVE-2025-61882 in the Oracle Configurator product of EBS, which allows unauthenticated remote code execution. The exploit uses a return URL parameter within an XML blob payload to trick the target server into calling back to the attacker's infrastructure, ultimately delivering a reverse shell. The exploit chain involves two main actors—the initial attacker controlling the exploit delivery and a second attacker infrastructure receiving the reverse shell payload via . The public IOCs published by Oracle incorrectly listed the leaked exploit as fixed by CVE-2025-61884, causing confusion, as researchers noted the actual exploit targeted the endpoint. The threat actor, associated with CLOP ransomware and sometimes misattributed to Russian actors due to language checks in their payloads, is likely collaborating with or has expanded its partnership with the Scattered Lapsus$ Hunters group. The exploit leverages Java deserialization within the payload to execute arbitrary commands on the target system, including both Linux ( ) and Windows ( ) shells. The video concludes by showcasing the successful execution of the exploit, resulting in a reverse shell connection back to the attacker's machine.

Context: This video analyzes an active extortion campaign tracked by Google Threat Intelligence Group (GTIG) and Mandiant, which exploits zero-day vulnerabilities in Oracle E-Business Suite (EBS). The campaign, associated with the CLOP ransomware group, targets EBS customers by sending extortion emails after data theft. The technical focus is on dissecting a publicly leaked proof-of-concept (PoC) exploit, specifically examining the communication flow and the mechanisms used to achieve remote code execution.