Hackers Target Executives with Extortion Emails After Reported Oracle Apps Data Breach

Google has revealed that hackers connected to a well-known ransomware group are sending extortion emails to executives at a variety of major companies, claiming to have stolen sensitive data from multiple business software products created by Oracle.

In a statement to TechCrunch, Genevieve Stark, head of cybercrime analysis at Google, mentioned that the hacking efforts began around September 29, although the tech giant has not yet confirmed the authenticity of their claims.

The emails have been traced back to hundreds of compromised accounts, including one tied to a financially driven cybercriminal group associated with the Clop ransomware gang.

According to Charles Carmakal, the chief technology officer of Google’s incident response team Mandiant, the harmful emails sent to executives included contact addresses found on Clop’s data leak site. The hackers use this site to pressure victims into paying for the deletion of stolen files.

Clop is a highly active hacking organization that has targeted numerous businesses in recent years by exploiting unknown security vulnerabilities, referred to as zero-day flaws. This strategy has allowed the group to infiltrate multiple organizations at once, leading to data theft that impacts tens of millions of individuals.

Bloomberg reported that in one case, the hackers demanded $50 million from an affected company, as noted by the counter-ransomware firm Halcyon, which is actively addressing the hacking campaign but has not responded to TechCrunch’s request for comment.

According to Bloomberg, the hackers utilized compromised user emails and manipulated the default password-reset features to gain valid credentials for Oracle E-Business Suite web portals accessible online.

Oracle E-Business Suite refers to a suite of products designed by Oracle to aid companies in managing customer databases, employee information, and human resources documents. Oracle asserts on its website that thousands of organizations globally depend on its E-Business Suite for their operations.

An Oracle spokesperson, Deborah Hellinger, did not respond to requests for comment on Thursday.

If you have more information about the extortion campaign or are an executive who has received such a threat, we want to hear from you and can guarantee your anonymity. Please securely reach out to this reporter via encrypted message at zackwhittaker.1337 on Signal.