Google warns executives of mass extortion emails citing Oracle app data theft

In a troubling development, Google has alerted businesses about a surge in extortion emails aimed at executives, with perpetrators alleging they have acquired sensitive data from Oracle's business applications. The tech giant disclosed that this campaign prominently references the Oracle E-Business Suite and is being executed on a widespread scale. However, Google has not confirmed the authenticity of the claims made by the attackers. According to their statement, the outreach appears to be orchestrated by a group that claims to be associated with the notorious cl0p ransomware gang. While Google has withheld specific numbers regarding the organizations impacted or the nature of the supposed stolen data, the threats being issued are alarmingly high. Cynthia Kaiser, head of Halcyon’s Ransomware Research Center, indicated that extortion demands can range from millions to tens of millions of dollars, with some reaching as high as $50 million. Kaiser emphasized the complexity of tracing these attacks, noting significant overlap among various criminal groups and the prevalence of copycat incidents in the cybercrime landscape. "The interconnections between these groups can be quite intricate, and there are numerous imitators operating in this space," she explained. The cl0p group, known for its involvement in major data breaches and extortion schemes, has not provided clarity regarding its involvement in this current wave of threats. In a message to Reuters, they stated they were "not prepared to discuss details at this time." Experts in incident response are strongly advising recipients of these emails to refrain from interacting with the senders, preserve any evidence for law enforcement, and collaborate closely with their internal security teams. Additionally, organizations utilizing Oracle E-Business Suite are being urged to scrutinize access logs, identify any irregularities, and ensure that they have the latest security patches and identity protections in place.