⚡ Weekly Recap: WhatsApp Worm, Critical CVEs, Oracle 0-Day, Ransomware Cartel & More

Summary: Google Threat Intelligence Group and Mandiant report that dozens of organizations may have been impacted by zero-day exploitation of a flaw in Oracle E-Business Suite since August 9, 2025, with activity bearing hallmarks of the Cl0p ransomware crew. The attack chains combined multiple vulnerabilities, including CVE-2025-61882 (CVSS 9.8), to breach networks and exfiltrate data, dropping malware families GOLDVEIN.JAVA, SAGEGIFT, SAGELEAF, and SAGEWAVE, while Oracle released updates for a second EBS flaw, CVE-2025-61884, without saying whether it was exploited in the wild.
What you should know: A CVSS 9.8 zero-day in Oracle E-Business Suite has been exploited since August 9, 2025, and the pattern points to Cl0p, a crew whose model is to steal data first and extort later - so patching now does not undo an exfiltration that may already have happened.

Read the original at The Hacker News ↗