Scmagazine

Washington Post Confirms Breach from Oracle EBS Attacks by Cl0p Ransomware Gang

First seen 8 Nov 2025, 12:36 UTC • Cybernews

•79.0

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

The Washington Post has confirmed it is a victim of the ongoing attacks targeting Oracle E-Business Suite, attributed to the Cl0p ransomware group. This breach is part of a larger campaign affecting numerous organizations, with the newspaper's name appearing prominently on the gang's dark leak site.

How this analysis works

Attack Flow

26 entities, 56 inferred relationships (STIX 2.1).

Technique (3)

Data Breach
Ransomware
Supply Chain Attack

Campaign (3)

MOVEIT exploit campaign
Oracle E-Business Suite campaign
Oracle hacking campaign

Organization (11)

American Airlines
Chicago Public Schools
DXC Technology
Emerson
Envoy
Envoy Air
Harvard University
Schneider Electric
The Washington Post
Washington Post
Wits University

Vulnerability (2)

CVE-2025-61882
Moveit

Indicator (1)

washingtonpost.com

Affected Platform (1)

Oracle E-business Suite

Threat Actor (3)

Cl0p
Clop
FIN11

Tool (2)

Cleo file transfer programs
Fortra GoAnywhere

Relationships

Cl0p uses Cleo file transfer programs
Cl0p uses Fortra GoAnywhere
Clop uses Cleo file transfer programs
Clop uses Fortra GoAnywhere
FIN11 uses Cleo file transfer programs
FIN11 uses Fortra GoAnywhere
Cl0p uses Data Breach
Cl0p uses Ransomware
Cl0p uses Supply Chain Attack
Clop uses Data Breach
Clop uses Ransomware
Clop uses Supply Chain Attack
FIN11 uses Data Breach
FIN11 uses Ransomware
FIN11 uses Supply Chain Attack
Cl0p exploits CVE-2025-61882
Cl0p exploits Moveit
Clop exploits CVE-2025-61882
Clop exploits Moveit
FIN11 exploits CVE-2025-61882
FIN11 exploits Moveit
Cleo file transfer programs exploits CVE-2025-61882
Cleo file transfer programs exploits Moveit
Fortra GoAnywhere exploits CVE-2025-61882
Fortra GoAnywhere exploits Moveit
MOVEIT exploit campaign attributed to Cl0p
MOVEIT exploit campaign attributed to Clop
MOVEIT exploit campaign attributed to FIN11
Oracle E-Business Suite campaign attributed to Cl0p
Oracle E-Business Suite campaign attributed to Clop
Oracle E-Business Suite campaign attributed to FIN11
Oracle hacking campaign attributed to Cl0p
Oracle hacking campaign attributed to Clop
Oracle hacking campaign attributed to FIN11
CVE-2025-61882 targets Oracle E-business Suite
Moveit targets Oracle E-business Suite
Cl0p targets American Airlines
Cl0p targets Chicago Public Schools
Cl0p targets DXC Technology
Cl0p targets Emerson
Clop targets American Airlines
Clop targets Chicago Public Schools
Clop targets DXC Technology
Clop targets Emerson
FIN11 targets American Airlines
FIN11 targets Chicago Public Schools
FIN11 targets DXC Technology
FIN11 targets Emerson
Cl0p related to Envoy
Cl0p related to Envoy Air
Cl0p related to Harvard University
Cl0p related to Schneider Electric
Cl0p related to The Washington Post
Cl0p related to Washington Post
Cl0p related to Wits University
Cl0p related to washingtonpost.com

Continue Reading

Logitech Confirms Data Breach from Zero-Day Exploit by Clop Gang Cl0p Ransomware Group Claims Data Theft from Nearly 50 Companies EU Sanctions Russia Over Ongoing Cyber Espionage Campaign ShinyHunters Exploits Oracle PeopleSoft Zero-Day Vulnerability AI-Generated Exploits Target Siemens PLCs in Critical Infrastructure Logitech Confirms Data Breach Due to Zero-Day Exploit by Clop Gang

Washington Post Confirms Breach from Oracle EBS Attacks by Cl0p Ransomware Gang

Article Content

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Continue Reading