Google warns executives are being targeted for extortion with leaked Oracle data

Google has warned that hackers are attempting to extort executives at a variety of companies after stealing data from Oracle apps.

The flood of extortion emails are being sent to executives at large organisations, as well as their IT departments, and appear to be showing evidence of a breach involving Oracle's E-Business Suite. Oracle has yet to reply to a request for comment.

The extortion emails began arriving on or before 29 September, according to Google, which said in a statement that attackers were sending extortion emails to "executives at numerous organizations claiming to have stolen sensitive data from their Oracle E-Business Suite."

30% off Keeper Security's Business Starter and Business plans

Keeper Security is trusted and valued by thousands of businesses and millions of employees. Why not join them and protect your most important assets while taking advantage of this special offer?

View Deal

Security firm Halcyon told Bloomberg it had seen demands for "seven- and eight-figure ransoms" over the last few days – and even one for $50 million.

Another Cl0p attack?

Google said the attackers are potentially from FIN11, a group affiliated with Cl0p, a ransomware gang believed to be responsible for a wide range of attacks, including banks and utilities – and behind the MOVEit File Transfer supply chain attack that also saw victims contacted with extortion demands.

"We are currently observing a high-volume email campaign being launched from hundreds of compromised accounts and our initial analysis confirms that at least one of these accounts has been previously associated with activity from FIN11, a long-running financially motivated threat group known for deploying ransomware and engaging in extortion," said Charles Carmakal, CTO of Mandiant – Google Cloud, according to a report on BleepingComputer.

"The malicious emails contain contact information, and we've verified that the two specific contact addresses provided are also publicly listed on the Clop data leak site," Carmarkal reportedly added to CyberScoop.

However, in a statement to Reuters, Google stressed that it "does not currently have sufficient evidence to definitively assess the veracity of these claims."

Austin Larsen, an analyst at Google Threat Intelligence Group (GTIG), said on social media that his organization was tracking the "high-volume extortion campaign" and the actor was claiming Cl0p affiliation, but added "we cannot yet substantiate the actor's data breach claims."

Breach details remain unclear

It remains unclear how the hackers obtained access, with GTIG saying it wasn't yet possible to say which specific malware was used.

"The primary indicators of this new campaign are the extortion emails themselves and the use of email addresses associated with the Clop data leak site," Genevieve Stark, head of cybercrime and information operations intelligence analysis at GTIG reportedly said. "At this time, we do not have evidence of a successful data breach or a specific malware family associated with this particular campaign."

Halcyon added that it appears the criminals accessed Oracle E-Business Suite by compromising user email accounts and making use of the password reset functions to access the software.

Oracle E-Business Suite is used to manage everything from financial data to human resources, supply chains and customer relationships – if compromised, a wide range of information could have been breached. Back in 2018, the US government warned about vulnerabilities in Oracle software, with severe flaws found in Oracle's E-Business Suite in 2019.

Any companies that receive the extortion emails should investigate their systems for signs of access, Google noted.

Make sure to follow ITPro on Google News to keep tabs on all our latest news, analysis, and reviews.

MORE FROM ITPRO

• MOVEit File Transfer supply chain attack
• What is ransomware