Security Bulletin: March 2025

Oracle Cloud breached, with 6 million records exfiltrated

Threat Actor

Tactics, Techniques, and Procedures (TTPs):

Initial Access:

• Suspected use of an undisclosed (zero-day) vulnerability.

• Vulnerability likely present in Oracle WebLogic servers used for hosting the login pages for oraclecloud.com.

• Targeted the login endpoint: login.(region-name).oraclecloud.com.

Data Exfiltration:

• Dumped approximately 6 million records from Oracle Cloud’s SSO and LDAP.

• Data includes JKS files, encrypted SSO passwords, key files, and enterprise manager JPS keys.

Post-Compromise Activity:

• Extortion: Demanding payment from affected tenants (over 140,000) for data removal.

• Incentivizing decryption: Offering incentives for help decrypting SSO and LDAP passwords.

• Social Media: Created an X (formerly Twitter) page and followed Oracle-related accounts.

Modus Operandi (MO):

• Vulnerability Exploitation: Identify and exploit a vulnerability in Oracle WebLogic servers used for Oracle Cloud login pages.

• Data Extraction: Gain unauthorized access to SSO and LDAP data, extracting sensitive information like passwords, keys, and JKS files.

• Data Storage and Leverage: Store the exfiltrated data and use it for extortion.

• Extortion and Demands: Contact affected organizations, demanding payment for the removal of their data from the compromised set.

• Incentivize Further Compromise: Offer rewards for assistance in cracking encrypted passwords, potentially increasing the impact of the breach.

Report Credit:

The Biggest Supply Chain Hack Of 2025: 6M Records For Sale Exfiltrated from Oracle Cloud Affecting over 140k Tenants | CloudSEK

CloudSEK uncovers a major breach targeting Oracle Cloud, with 6 million records exfiltrated via a suspected undisclosed vulnerability. Over 140,000 tenants are impacted, as the attacker demands ransom and markets sensitive data online. Learn the full scope, risks, and how to respond. Are you worried your organization might be affected? Check your exposure here - https://exposure.cloudsek.com/oracle

https://www.cloudsek.com/blog/the-biggest-supply-chain-hack-of-2025-6m-records-for-sale-exfiltrated-from-oracle-cloud-affecting-over-140k-tenants

Confluence Exploit Leads to LockBit Ransomware

Threat Actor:

Tactics, Techniques, and Procedures (TTPs):

Initial Access:

• T1190 Exploit Public-Facing Application: Exploitation of CVE-2023-22527 (Confluence RCE vulnerability) on an exposed Windows Confluence server.

Execution:

• T1218.005 Signed Binary Proxy Execution: Mshta: Used mshta.exe to download and execute a Metasploit stager.

• T1059.001 Command and Scripting Interpreter: PowerShell: Used PowerShell for various tasks, including downloading AnyDesk, deobfuscating and executing shellcode, clearing event logs and disabling Windows Defender.

Persistence:

• T1543.003 Create or Modify System Process: Windows Service: Installed AnyDesk as a service for persistent remote access.

• T1136.001 Create Account: Local Account: Created a new local account (“backup”) and added it to the Administrators group.

Privilege Escalation:

• Confluence RCE provided SYSTEM access.

• Exploited the initial access to create a local administrator account.

• T1068 Exploitation for Privilege Escalation: Used the Confluence RCE vulnerability to gain SYSTEM privileges initially.

Defense Evasion

• T1562.001 Impair Defenses: Disable or Modify Tools: Turned off Windows Defender via the GUI.

• T1070.001 Indicator Removal on Host: Clear Windows Event Logs: Cleared Windows event logs on the file server.

• Deleted files they brought into the environment.

Command And Control

• T1573.001 Encrypted Channel: Symmetric Cryptography: Metasploit communication was likely encrypted.

• T1071.001 Application Layer Protocol: Web Protocols: Used HTTP for downloading the Metasploit stager.

• T1219 Remote Access Software: Used AnyDesk for remote access and control.

Exfiltration

• T1567.002 Exfiltration Over Web Service: Exfiltration to Cloud Storage: Used Rclone to exfiltrate data to MEGA.io cloud storage.

Modus Operandi (MO)

• Exploit Confluence vulnerability (CVE-2023-22527).

• Deploy Metasploit stager and AnyDesk for persistent access.

• Use Mimikatz and other tools to steal credentials.

• Deploy LockBit ransomware using PDQ Deploy for automated distribution, and manual execution on critical servers.

Report Credit

Confluence Exploit Leads to LockBit Ransomware

Key Takeaways The intrusion began with the exploitation of CVE-2023-22527 on an exposed Windows Confluence server, ultimately leading to the deployment of LockBit ransomware across the environment.…

https://thedfirreport.com/2025/02/24/confluence-exploit-leads-to-lockbit-ransomware/