Urgent: Google Alerts on Oracle Ransomware Extortion Campaign

URGENT UPDATE: A new extortion campaign targeting executives from major companies has emerged, with a notorious ransomware group demanding access to sensitive data allegedly stolen from Oracle Corp. This alarming information was revealed by Genevieve Stark, head of cybercrime at the Google Threat Intelligence Group, alongside three additional sources familiar with the issue.

The extortion attempts reportedly began on or before September 29, 2025, using compromised third-party email accounts to send threatening messages about data theft linked to Oracle’s E-Business Suite applications. These emails contained the group’s characteristic grammatical errors, along with contact information found on the Cl0p website and an email address associated with a Cl0p affiliate.

As the situation develops, Google has yet to confirm the accuracy of the extortion claims due to a lack of sufficient evidence. Sources have refrained from disclosing the identities of the targeted executives or confirming whether any ransom has been paid, raising urgent concerns across the business community.

“This campaign showcases the evolving threat landscape in cybersecurity, especially targeting major corporations and their sensitive data,” said Stark.

Cl0p is infamous for its sophisticated attacks, using advanced malware to encrypt files and extort ransoms for decryption. In 2023, the group exploited vulnerabilities in MOVEit, a critical file transfer product, compromising data from hundreds of organizations. Notable victims include Shell Plc, British Airways, and the BBC.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued an advisory in June 2023, labeling Cl0p as one of the largest distributors of phishing and spam globally. Estimates suggest that Cl0p has compromised over 3,000 organizations in the U.S. alone, with more than 8,000 organizations affected worldwide.

With the threat of extortion looming, executives are urged to tighten their cybersecurity measures and remain vigilant against potential attacks. The implications for businesses are profound, as the fallout from such breaches can lead to significant financial losses and damage to reputations.

As new information surfaces, stakeholders and the public are encouraged to monitor updates closely. The urgency of this situation highlights the critical need for robust cybersecurity protocols in today’s digital landscape.

Stay tuned for further developments as authorities continue to investigate this escalating extortion campaign.