Exploitation of Oracle EBS Zero-Day Started 2 Months Before Patching

AI-suggested

European organizations should immediately inventory all Oracle E-Business Suite instances, prioritizing those exposed to the internet. Apply Oracle's official patches for CVE-2025-61882 without delay, ensuring all components, especially BI Publisher Integration, are updated. Implement network segmentation to isolate Oracle EBS systems from direct internet access, employing firewalls and access control lists to restrict inbound traffic to trusted sources only. Deploy intrusion detection and prevention systems (IDS/IPS) with updated signatures to detect exploitation attempts. Monitor logs and network traffic for indicators of compromise associated with Cl0p and Graceful Spider activity, including unusual data exfiltration patterns and extortion communications. Conduct threat hunting exercises focused on the exploit chain's tactics and techniques. Consider deploying web application firewalls (WAFs) with custom rules to block exploit attempts. Engage in proactive threat intelligence sharing with industry peers and national cybersecurity centers to stay informed on emerging exploitation trends. Finally, develop and test incident response plans tailored to ransomware and data breach scenarios involving Oracle EBS.