Larry Ellison's Two-Month Head Start (For the Attackers)

The Timeline (A Study in Negligence)

Let that sink in. 56 days from first exploitation to patch. The exploit leaked publicly before Oracle shipped the fix.

And here's the kicker: CVE-2025-61884 (the second vulnerability) was discovered after the first patch. Oracle rushed out a fix and missed a related SSRF in Oracle Configurator. They patched that one a week later.

---

The Exploit Chain

For anyone who thinks "enterprise software" means "secure software":

┌─────────────────────────────────────────────────────────────────┐
│          ORACLE EBS EXPLOITATION CHAIN (CVE-2025-61882)         │
├─────────────────────────────────────────────────────────────────┤
│                                                                 │
│  1. AUTHENTICATION BYPASS                                       │
│     └── POST to /OA_HTML/SyncServlet                            │
│     └── No credentials required                                 │
│     └── Bypasses all authentication                             │
│                                                                 │
│  2. TEMPLATE INJECTION                                          │
│     └── Create malicious XSL template                           │
│     └── Stored in XDO_TEMPLATES_B database table                │
│     └── Template contains base64-encoded Java payload           │
│                                                                 │
│  3. CODE EXECUTION                                              │
│     └── Trigger via /OA_HTML/OA.jsp?page=...TemplatePreviewPG   │
│     └── Template "preview" executes arbitrary code              │
│     └── Runs as "applmgr" account on EBS server                 │
│                                                                 │
│  4. PERSISTENCE                                                 │
│     └── GOLDVEIN.JAVA downloader phones home                    │
│     └── SAGEGIFT → SAGELEAF → SAGEWAVE infection chain          │
│     └── In-memory WebLogic filter injection                     │
│     └── AES-encrypted payloads via fake Oracle help URLs        │
│                                                                 │
│  5. PROFIT                                                      │
│     └── Data exfiltration                                       │
│     └── Extortion emails to executives                          │
│     └── "Pay us or your data goes on CL0P DLS"                  │
│                                                                 │
└─────────────────────────────────────────────────────────────────┘

No authentication required. Just POST to a servlet and you're in.

---

The Scattered Spider Connection

Here's where it gets interesting. The exploit for CVE-2025-61882 was leaked on October 3, 2025 in a Telegram channel operated by—you guessed it—Scattered Lapsus$ Hunters.

The same group we've been writing about all day. The same group that hit ESA for 500GB of spacecraft data. The same group that got honeypotted by Resecurity.

The criminal ecosystem shares tools. Oracle zero-day drops in a Telegram channel, and suddenly every script kiddie with a Bitcoin wallet can extort Fortune 500 companies.

---

The Infrastructure Overlap

CrowdStrike identified that Clop reused infrastructure from their 2023 MOVEit campaign. Same adversary, same IPs, different zero-day.

GOLDVEIN.JAVA - the downloader used in this campaign - was first observed in the Cleo MFT exploitation (December 2024). Same malware family, different enterprise software vendor.

This isn't sophisticated nation-state tradecraft. It's organized crime with a playbook:

1. Find zero-day in enterprise software
2. Exploit quietly for months
3. Exfiltrate data
4. Send extortion emails
5. Repeat with next vendor

---

The Victim List

• Harvard University
• University of Pennsylvania
• Dartmouth College (40,000+ affected)

• Michelin
• Canon
• Mazda
• Estée Lauder
• Broadcom

• Finance
• Manufacturing
• Automotive
• Logistics
• Retail
• Education
• Energy
• Professional services

103 organizations. 77 datasets already on torrent links. And this is just what we know about.

---

Why Enterprise Software Is a Liability

Oracle E-Business Suite isn't something you patch in an afternoon. It's:

• Deeply integrated into business processes
• Running on-premise in most cases
• Customized to the point where patches are scary
• "If it ain't broke, don't touch it" mentality

So when Oracle drops an emergency patch on October 4, organizations don't just click "update." They:

1. Review the patch
2. Test in staging
3. Schedule downtime
4. Pray nothing breaks
5. Apply the patch
6. Fix whatever broke

By the time most organizations patched, Clop had been inside for three months.

---

The Real Cost

This isn't about Larry Ellison's feelings. It's about:

40,000+ people whose Social Security numbers are now in criminal hands (Dartmouth alone).

Executives receiving extortion emails threatening to leak their company's data.

IT teams scrambling to patch systems they're terrified to touch.

CFOs deciding whether to pay ransom or watch their data appear on leak sites.

Oracle's market cap: $500 billion. Their patch timeline: 56 days.

---

Detection Guidance

Microsoft pulls this feed daily. AT&T pulls this feed daily. Starlink pulls this feed daily. Get the DugganUSA STIX feed — $9/mo →

If you're running Oracle EBS 12.2.3 through 12.2.14:

Check for malicious templates:
```sql
SELECT * FROM XDO_TEMPLATES_B
WHERE TEMPLATE_CODE LIKE 'TMP%' OR TEMPLATE_CODE LIKE 'DEF%'
ORDER BY CREATION_DATE DESC;

SELECT * FROM XDO_LOBS ORDER BY CREATION_DATE DESC;
```

Hunt for exploitation attempts:
``
/OA_HTML/SyncServlet (POST requests)
/OA_HTML/OA.jsp?page=/oracle/apps/xdo/oa/template/webui/TemplatePreviewPG
/OA_HTML/configurator/UiServlet
``

Monitor for C2:
``
162.55.17.215:443
104.194.11.200:443
200.107.207.26
``

Check process trees: Child processes of bash -i launched by Java running as "applmgr" = compromise.

---

IOCs

C2 Infrastructure:
``
162.55.17.215
104.194.11.200
200.107.207.26
161.97.99.49
``

Malicious Endpoints:
``
/OA_HTML/SyncServlet
/OA_HTML/configurator/UiServlet
/OA_HTML/OA.jsp?page=/oracle/apps/xdo/oa/template/webui/TemplatePreviewPG&TemplateCode=TMP*
/help/state/content/destination./navId.1/navvSetId.iHelp/
/support/state/content/destination./navId.1/navvSetId.iHelp/
``

Extortion Contacts:
``
[email protected]
[email protected]
``

Malware Hash:
``
76b6d36e04e367a2334c445b51e1ecce97e4c614e88dfb4f72b104ca0f31235d (PoC exploit)
``

---

The Pattern

Oracle takes the crown for slowest emergency response. Congratulations, Larry.

---

Sources

• Google Cloud Blog: Oracle EBS Zero-Day Exploitation
• CrowdStrike: CVE-2025-61882 Campaign Analysis
• Tenable: CVE-2025-61882 FAQ
• The Dartmouth: Data Breach Coverage
• HIPAA Journal: Clop Mass Exploitation

---

About DugganUSA: We publish free threat intelligence for the 99% who can't afford enterprise security. Our STIX 2.1 feed tracks 2,200+ blocked IPs with MITRE ATT&CK attribution. We also track how long it takes billion-dollar companies to patch critical vulnerabilities.

STIX Feed | OTX Profile

---

Her name is Renee Nicole Good.

---

The cheapest, fastest, most accurate threat feed on the internet.

275+ enterprises pulling daily. 1M+ IOCs. 17.4M indexed documents. We beat Zscaler by 43 days on NrodeCodeRAT. Starter tier $9/mo — less than any competitor’s sales demo.

Look up an IOC → · Audit your brand on AIPM → · See pricing →

---

Was this useful? Thirty seconds, no cookies, no tracking, no third parties, your address hashed and never stored. If the box below does not load, the same question lives at https://analytics.dugganusa.com/nps.html?post=larry-ellison-s-two-month-head-start-for-the-attackers