Cyber Intelligence Briefing: 06 October 2025

Assured’s CISO reacts:

Advice for Oracle engineers and security practitioners:

1) Patch & prerequisites (change window ASAP)

1. Verify release & CPU level on every EBS env (PROD, DR, non-prod).
2. Apply the Oct 2023 Critical Patch Update if it is not already present (Oracle states it’s required). (Oracle)
3. Apply the Security Alert patch for CVE-2025-61882 for 12.2.3–12.2.14 from My Oracle Support (MOS). (Oracle)
4. If you deferred July 2025 CPU items affecting EBS, apply those as well, as Clop chained multiple vulnerabilities from July and this zero-day.

2) Exposure reduction (immediately)

• Ensure EBS app tier isn’t internet-reachable except through your reverse proxy/WAF; block direct HTTP to Concurrent Processing / BI Publisher endpoints. (Attack vector is unauthenticated HTTP) (Oracle)
• Restrict outbound egress from EBS servers; block unknown TCP reverse shells and alert on atypical outbound connections. (Matches observed reverse-shell behaviour.) (Oracle)
• WAF/IDS rules: temporarily block requests containing suspicious BIP execution/bursting patterns and inspect unusual HTTP POSTs to EBS. (Exploit uses HTTP GET/POST per Oracle.) (Oracle)

3) Hunt & triage

Search across all EBS hosts and reverse proxies for the last 60–90 days:

• Network: any hits to/from 200.107.207.26 or 185.181.60.11; unexpected outbound connections from app servers. (Oracle)
• Process audit: shells or Python invoked by the EBS app user; look for the reverse-shell command pattern Oracle shared. (Oracle)
• Filesystem: artefacts or filenames related to the leaked exploit archive (hashes in the advisory). (Oracle)
• App logs: unusual BI Publisher job submissions, concurrent requests executing OS commands, spikes in HTTP 500/200 on relevant endpoints around the timeframe Aug–Oct 2025 (Clop activity window). (BleepingComputer)

4) If you find indicators / suspicious activity…

• Isolate the app tier, capture volatile data, and rotate all credentials (EBS app, DB, OS, integration accounts, SSO secrets).
• Review data exfiltration risk: check reverse proxy logs, database audit, and BI Publisher output/bursting destinations for large exports.
• Engage IR (internal playbook + vendor) and consider notifying Oracle Support with IOC findings for tailored guidance.
• Legal/comms: Prepare for potential extortion emails spoofing/compromised accounts; Mandiant/Google observed mass extortion mailouts tied to this campaign. (BleepingComputer)

5) Hardening (post-patch)

• Stop/disable unused BI Publisher integrations on EBS where possible, and ensure least-privilege access for the Concurrent Processing accounts.
• Segmentation: EBS in its own VLAN with deny-by-default egress; only allow required outbound (SMTP relay, SSO, etc.)
• Monitoring: permanent alerts for reverse shells, unexpected Python/bash under the EBS user, and large report exports.

Assured’s CISO reacts:

The trend revealed by this Google data indicates that attackers are moving faster than ever, often striking before defenders have a chance to patch. It highlights the importance of strong incident response planning and cyber insurance to help organisations recover from attacks that can’t be prevented through patching alone.

While we can’t control the uncontrollables, we can control timely patching. Automate patch deployment (with patch rings, canary devices, etc.) so that patches are rolled out as soon as they are available. It’s also important to plan for the possibility of no patch. Good incident response plans should make provisions for exploits that cannot be patched.

Assured’s CISO reacts:

This incident reminds us of the LockBit ransomware attack on a children’s hospital in Toronto, Canada (SickKids Hospital), in December 2022.  In that incident, the LockBit operators issued a public apology on their leak site, claiming that one of their affiliates had violated group policy by targeting a healthcare organisation. They offered a free decryptor key to the hospital and said the responsible affiliate had been “blocked.”

These examples serve as a reminder of the importance of PR to go on the offensive and turn public opinion against the threat groups. External communication strategy should therefore be considered as part of crisis planning.