eSentire's Threat Response Unit (TRU) compiles the following weekly intelligence overview, providing cybersecurity leaders with expert analysis and insights on the most important events of the past week along with important security tips.
Recent Threat Intelligence Advisories
Noteworthy News
Oracle E-Business Suite Zero-Day Exploited in Widespread Extortion Campaign
Bottom Line: Oracle has confirmed the existence of an actively exploited zero-day vulnerability, CVE-2025-61882, impacting its E-Business Suite. The vulnerability has been exploited in a widespread data extortion campaign linked to the FIN11 and CLOP threat actor groups.
On October 9th, 2025, the Google Threat Intelligence Group (GTIG) and Mandiant released a report detailing new findings related to the extortion campaign, linked to the CLOP extortion group, targeting the Oracle E-Business Suite (EBS). The campaign was initially highlighted by GTIG, where executives at various organizations started receiving extortion demands via email since September 29th, 2025. Oracle subsequently confirmed on October 4th, 2025, that the campaign involved exploitation of a vulnerability identified as CVE-2025-61882 to exfiltrate sensitive information. Google’s investigation identified that the exploitation activity began as early as August 9th, 2025, and the exploitation attempts dating back to July 10th, 2025.
In July 2025, suspicious activity targeting EBS was detected through application logs. The identified artifacts showed similarities with exploit code that had been leaked on a Telegram channel managed by the Scattered LAPSUS$ Hunters group on October 3rd, 2025. The group asserted that the zero-day exploit was originally theirs and had been leaked and sold to the CLOP group. The analysis by watchTowr Labs of the leaked code revealed that it employed Server-Side Request Forgery (SSRF), Carriage Return Line Feed (CRLF) injection, authentication bypass, and XSL template injection techniques to achieve Remote Code Execution (RCE) on vulnerable Oracle EBS servers. The analysis suggests that CVE-2025-61882 is comprised of multiple flaws and additional vulnerabilities may exist in the product.
Mandiant observed exploitation attempts both prior and post Oracle July 2025 patch release involving suspicious HTTP traffic from different IP address. The attempts post exploit suggested presence of SSRF vulnerability in Oracle EBS. In August 2025, the SyncServlet component in EBS was exploited for unauthenticated RCE. The attacker used EBS’s XDO Template Manager to create a malicious XSL template within the EBS instance. The XSL payload embedded with Java payloads was triggered via the Template Preview functionality. GTIG identified two different chains of Java payloads. One of the two deployed GOLDVEIN.JAVA- Downloader, a Java variant of GOLDVEIN downloader. The malware can connect to Command-and-Control (C2) server to retrieve and execute second-stage payload. The second chain involved multiple Java payloads including SAGELEAF, an in-memory dropper, installed by SAGELIFT loader, and SAGEWAVE servlet filter that deploys the main payload, which is yet unknown. The threat actor was observed executing reconnaissance commands from the EBS account “applmgr”.
eSentire Threat Intelligence Analysis:
Initially, GTIG associated this campaign with the CLOP extortion group, as extortion emails contained two contact addresses found on the CLOP Dedicated Leak Site (DLS). However, the report underscores overlap with activities attributed to the financially motivated threat actor FIN11. According to the report, the purported victims seem linked to data extortion incidents associated with FIN11. The pattern of exploiting a zero-day vulnerability on a large scale, followed by branded extortion weeks later, is characteristic of FIN11 campaigns. Moreover, the malware toolkit observed in the extortion campaign bears similarities to malware previously associated with the FIN11 cluster UNC5936. It is also noteworthy that FIN11 is connected to the CLOP ransomware, employed by the CLOP group in earlier campaigns before they shifted towards conducting data theft and extortion attacks. The Oracle EBS extortion campaign serves as an example of the complex interconnectedness among threat actors, thereby complicating precise attribution efforts for security researchers.
The Scattered LAPSUS$ Hunters group’s assertion of ownership of the exploit is supported by analyses from watchTowr Labs and GTIG, showing similarities in the exploit techniques, such as achieving pre-authenticated RCE and deploying XSL payloads. The group also claims to have developed more advanced exploit chains aimed at EBS, indicating potential ongoing interest. Nonetheless, GTIG currently assesses that the Scattered LAPSUS$ Hunters group has not been involved in any exploitation activities to date. As highlighted by watchTowr Labs, CVE-2025-61882 comprises of minor flaws, and there may still be multiple undiscovered vulnerabilities affecting Oracle EBS. This suggests that other groups could potentially leverage these issues to conduct additional campaigns.
Organizations are recommended to apply the emergency patches to mitigate CVE-2025-61882 and avoid the risk of exploitation. The email addresses used by the threat actor to send extortion demands are likely obtained from information stealer malware logs that are sold on underground forums. Implementation of robust Endpoint Detection and Response (EDR) would help detect and contain malicious payloads like information stealers. Monitor environment for suspicious network traffic and malicious activities like the creation of rogue user accounts. eSentire has published a security advisory addressing CVE-2025-61882 on October 6th, 2025. eSentire MDR for Network has detections in place to identify CVE-2025-61882 exploitation activity and the Threat Response Unit (TRU) is actively tracking this topic for additional detection opportunities.
The ClickFix Factory: First Exposure of IUAM ClickFix Generator
Bottom Line: A new phishing kit called IUAM ClickFix Generator is being used to create highly customizable ClickFix-styled phishing pages to deliver information stealers and Remote Access Trojans (RATs).
On October 8th, 2025, Unit42 published a report on a newly identified phishing kit called IUAM ClickFix Generator, which has been used in recent campaigns to deliver malware through deceptive browser verification pages. The kit leverages a technique called ClickFix, which relies on social engineering to convince users to manually execute malicious commands. These campaigns have been observed distributing infostealers such as DeerStealer and Odyssey, targeting both Windows and macOS platforms.
The IUAM ClickFix Generator is designed to mimic browser verification challenges, such as those seen on Cloudflare-protected sites. It prompts users to copy and paste commands into their system's run dialog box or terminal. The kit is hosted on an exposed HTTP server and was active between July and October 2025. It is built using Express and Tailwind CSS, and includes features such as operating system detection, clipboard injection, mobile access blocking, customizable phishing page elements, and JavaScript obfuscation.
Unit 42 observed several campaigns that used the generator to deliver the infostealer. Campaign 1 is a Windows-focused DeerStealer campaign in which victims are instructed to open a Windows Run Dialog box and execute a PowerShell command that has been copied to their clipboard. This command downloads and runs a batch script, which installs the DeerStealer malware. The phishing page does not include logic to detect or respond to macOS users, meaning they receive no payload.
Campaign 2 includes three variations of phishing pages that targeted both macOS and Windows users. Variation 1 delivers the Odyssey Stealer to macOS users and an unknown malware to Windows users. Variation 2 focuses on macOS users, while Windows users receive a benign decoy command. Variation 3 exclusively targets macOS users and employs a bash command to ensure persistent execution. All three variations share similar structural elements and use consistent Command-and-Control (C2) infrastructure, suggesting they were generated using a shared builder or codebase.
eSentire Threat Intelligence Analysis:
The ClickFix IUAM Generator represents further commoditization of social-engineering tooling, enabling low-skill actors to orchestrate high-impact phishing campaigns that depend on user actions rather than detectable attachments. The kit’s multi-platform templates increase its operational reach by tailoring delivery to Windows or macOS systems, which raises the probability of successful execution across diverse user bases. Since its emergence in 2024, the ClickFix technique has been extensively utilized by numerous threat actors as an Initial Access Vector (IAV) for deploying malicious payloads. Over the span of a year, attacks employing this method have increased by 500%.
There is a risk that the same tooling could be upgraded to introduce alternate delivery vectors; one such technique, referred to by multiple researchers as FileFix, leverages similar social-engineering patterns to induce users to execute malicious commands. Although FileFix was not observed during the examination of the infection chain, the successful adoption of this technique would broaden the attack surface and supply attackers with an additional tactic for persistent, host-level compromise. Organizations should ensure that effective cyber security strategies are implemented to defend against these types of attacks. Recommendations include disabling the Windows Run box via Group Policy Object (GPO) to prevent users from being able to execute ClickFix attacks and implementing Phishing and Security Awareness Training (PSAT) programs to train users how to identify and report malicious content.
eSentire's Threat Intelligence team has observed a large spike in the ClickFix initial access method being used to deploy various information stealers and RATs over the past year. eSentire MDR for Network and MDR for Endpoint have detections in place to monitor for ClickFix-related traffic and post-exploitation activity. eSentire's Threat Response Unit (TRU) has published blogs and two advisories on ClickFix being used to deliver NightShadeC2, MintsLoader, Lumma Stealer, and NetSupportRAT. Given the adoption of the ClickFix technique by various threat actors, it is likely that the tools associated with it will continue to increase among additional threat groups in the future.
SonicWall Breach Disclosure Update
Bottom Line: SonicWall provided an update to a recent security breach, impacting their cloud backup service. SonicWall initially stated that less that 5% of customers were impacted but have since indicated that all customers who utilized this service were impacted by this breach, significantly increasing its scope.
On October 8th, 2025, SonicWall published an updated advisory, relating to the security incident that impacted the MySonicWall cloud backup service, initially disclosed by SonicWall in September 2025. The incident involved threat actors obtaining unauthorized access to firewall preference configuration backup files stored within the MySonicWall cloud backup service. These preference files contain sensitive information, such as encrypted credentials and configuration data for the associated firewall. At the time of initial disclosure, SonicWall indicated that the breach impacted less than 5% of customers that had backup firewall preference files stored in the cloud.
In their updated advisory, SonicWall stated that after their investigation into the incident, which was conducted alongside the Incident Response (IR) firm Mandiant, they concluded that an "unauthorized party accessed firewall configuration backup files for all customers who have used SonicWall’s cloud backup service". SonicWall stated that they are working to “notify all impacted partners and customers” and have also released tools which can be used to assist with device assessment and remediation. SonicWall issued a warning within the advisory to impacted customers that “possession of these files could increase the risk of targeted attacks”.
To assist with remediation efforts, SonicWall also released an updated and comprehensive list of impacted devices to the MySonicWall portal. The provided lists include a field that identifies devices as “Active - High Priority” for those that have Internet-facing services enabled, “Active - Lower Priority” for those without Internet-facing services, and “Inactive” for devices that have not “pinged home” for 90 days. SonicWall urges customers to verify within the MySonicWall portal if cloud backups exist for registered firewalls, and for impacted organizations to follow the mitigation steps listed within the Essential Credential Reset and Remediation Playbook Knowledge Base articles.
eSentire Threat Intelligence Analysis:
The recent update from SonicWall drastically expands the impact of the attack, from the number of affected customers being less than 5% to all of those who have enabled cloud backups for firewall devices within the MySonicWall cloud backup service. This update is notable as it confirmed an increase in the number of organizations that have had their firewall preference files exposed as a result of the attack, and followed speculation that SonicWall initially tried to downplay the scope of the incident. The breach also highlights the inherent security risks of third-party cloud storage solutions, where organizations place trust in other entities to protect their data.
The preference files that threat actors obtained access to contain sensitive information such as network rules, VPN setups, certificates, and device configurations. The files also contain encrypted credentials, with SonicWall noting that the encryption on these files “remains in place”. Firewall configuration files are often targeted by threat actors during attacks, as they can provide attackers with critical information regarding an organizations network setup. Examples of these types of files being targeted by threat actors within attacks include the suspected Chinese state-sponsored ArcaneDoor campaign, and by the threat actor UAT0218 following the exploitation of the critical Palo Alto vulnerability CVE-2024-3400 in Operation MidnightEclipse. In both campaigns, threat actors exfiltrated firewall configuration files which were likely used to perform system discovery and lateral movement. Although access to a targets network would likely be required to make use of the information contained within the exposed preference files, possession of these files could enable the threat actors responsible for the breach to conduct targeted attacks or prompt their sale to third party groups for further exploitation.
It is strongly recommended for organizations that utilize SonicWall firewalls within their networks to verify if they were impacted by this breach by confirming if cloud backups are enabled within the MySonicWall portal. Impacted organizations should follow the steps outlined by SonicWall within their advisory as soon as possible. eSentire's Threat Intelligence team covered SonicWall's initial breach disclosure within the Weekly Threat Briefing - September 15 - September 19, and continues to track this topic for additional information and detection opportunities.
About the threat briefings:
The threat briefing is a weekly intelligence overview for non-technical users. The Threat Intelligence team at eSentire investigates, analyzes, and organizes the most important events of the past week along with important security tips and redistributes the findings for quick reading. The main goal of this briefing is to improve the overall awareness of readers regarding cyber security.
