CL0P RANSOMWARE LISTS NHS UK AS VICTIM, DAYS AFTER WASHINGTON POST BREACH

Summary from the TLDR InfoSec newsletter

The Cl0p ransomware group claimed the NHS UK as a victim on November 11, days after breaching The Washington Post by exploiting CVE-2025-61882, a critical remote code execution vulnerability (CVSS 9.8) in Oracle E-Business Suite versions 12.2.3-12.2.14. The vulnerability was exploited beginning August 2025 before Oracle's October 4 emergency patch, with attacks accelerating after Scattered Lapsus$ Hunters leaked proof-of-concept code on October 3, enabling Cl0p and FIN11 to conduct synchronized data-exfiltration campaigns against hundreds of organizations. Organizations running Oracle EBS must immediately apply the October 2025 patch, conduct forensic reviews dating back to August, and monitor for connections to suspicious IP addresses 200.107.207.26 and 185.181.60.11.