The Cl0p-Oracle Extortion Emails, Red Hat Breach, and Sad Government News

So keep your eyes and ears out for that. That'll be a lot of fun. Really looking forward to this, this event in New York. Board games is one of my favorite movies. It's like childhood movie for me. So I think it should be a lot of fun. I know I can't wait to go watch war games several times up to this, so yeah, it's going to be great. It's a great one. I watched maybe the first hour of it last night after we were we were talking about it. It's just so great.

It's just like one of those movies where you sit down and you're so comfortable, like, Oh, yeah, here comes that scene. Here comes, you know, Matthew Broderick's dog running out the door and, you know, greeting Ally Sheedy. And here comes the goofy scenes at NORAD. I love it. I love it. It's so much fun. It's just, like, such an easy hang. Yeah. Yeah. I I do have some concerns about Matthew Broderick's dog that we can talk about in the War Games podcast, but like he always seems to be outside. I don't know what they're doing. Like, I'm not a dog owner, but I know you are. I don't the dogs never endorse.

I'm I have some problems with it. I don't know, that sounds that kind of sounds like a cat owner statement. It does sound like cat owner behavior. Yeah. All right, so yeah, we will. We'll have more information on that as as we get closer. But if you want to go and find it, you can, we will drop the link in the show notes for a material. They have a, a site up for it. You have to request tickets. It's it's free, but you do have to RSVP and and get yourself on the list.

So go do that. OK, digging into the news, let's start with the the CLOP story that we mentioned at the top. This is a weird thing. When I started seeing these, I think the first indication I saw of this yesterday, which would have been Thursday, was on LinkedIn. Weirdly enough, I saw a post from one of the Google threat intelligence folks saying, hey, we're seeing a bunch of extortion emails sent directly to business executives from it, what looked like a bunch of compromised e-mail accounts and saying we have your Oracle database and here's proof of it.

In some cases they have like screenshots and things like that and demanding pretty large. Like in one case I saw a report of a $50 million ransom demand to, which is completely insane. Like, I've never heard of any ransom demand that high in any ransomware case. I mean, at least not publicly reported. But Google did say they were like we we can't verify that any of these databases were actually leaked. You know, this is 24 hours ago now. And since then it's it's become verified. But it wasn't like a straight ransomware thing. It looks like from the details I saw that the attackers were abusing an old Oracle e-business Suite flaw. I think in some cases like brute forcing the default or the admin password reset thing, getting in, stealing a bunch of data and then sending these emails.

Which is kind of an old school tactic. Like no ransomware involved, just straight up data theft and pay us some money. I don't know how widespread it is. I haven't seen any real numbers on that. I've just seen there's a bunch of this stuff happening and there's a very terse acknowledgement from Oracle themselves. Most of the reporting is, you know, third party reporting from Google and Mandiant. But what was your first thought when you saw this? Because it again, it struck me as like, this is a little old school.

This is kind of odd. It's not what we're we've been seeing recently. Yeah, no, it was. It was really weird. And like you said, Oracle came back like they didn't initially respond to any of this, but they came out with a statement. I think it was like, you know, yesterday or like midday yesterday from the C so and they basically said that like some of their e-business suite customers received extortion emails. Like you said, they didn't give like a full like a, a number really of who, of how many have actually been impacted. I also reached out to Mandy and by the way and asked them and they, you know, didn't really give more details on that, but they said that their investigation found the use of flaws that have been addressed in July 2025. And what's interesting is if you go back and look at their patch update from July, you can see

that there's a couple specific vulnerabilities that impact e-business suite from that time. So you kind of get a sense of maybe what, what it could be, but it's, you know, it's interesting. Like you said, like the, the thing here that stuck out to me was like the data theft and extortion model, I think is, is continuing to, you know, be successful for threat actors or they're, they're at least seeming to find success in it as opposed.

And like, you know, this is something we've seen like like almost like a evolution or a shift from ransomware because, you know, ransomware is interesting, but they're like, I think there have been like a little bit more of like a protections that have been introduced. So maybe some threat actors are like moving beyond that model or starting to look into other models or attacks that that stuck out to me at least. And you know, I'm also curious to like, like I saw like a couple people talked about what the emails said themselves that and I know basically the threat actor said that it would provide proof of compromise.

Like I think they said like 3 files or like a data row that like that the compromise happened. So yeah, I'm really curious to see kind of how this goes. It's interesting to me that yeah, this seems easier and simpler for the attackers because they don't have to worry about the ransomware part of it. You know, they're just like, OK, we found this old bug, details are public, Let's go and see if we can find a bunch of Expo Internet exposed instances of this product that we can try and exploit.

Holy shit, we found a bunch of them. Let's see what we can do with this. And it takes less effort than deploying ransomware and going through that whole chain of events. It's just straight up, here's some proof. Send an e-mail to the, you know, CEO or CFO or C so or somebody and ask for a bunch of money. And the interesting part to me is from like the victim perspective, it's not as disruptive as ransomware, obviously, because you can still, the business is still operating.

Like they haven't encrypted your database. They haven't destroyed anything as as far as I've heard. It could be extremely embarrassing if they publish a bunch of payroll records or you know, customer contracts or whatever they happen to have stolen. But you can still operate your business. You, you know, it's going to be ugly, but you can still run the business. And I wonder if there is a path to them deploying ransomware after this. I don't know if there, you know, if maybe that's the second stage of this whole thing. If, if these actors decide like, OK, not enough people are paying now let's go to stage 2 and see what kind of mess we can make there.

I have no idea. We haven't heard about that yet, but it could be a possibility. I don't know. Yeah, Yeah. To your point, it is funny like, you know, the impact of releasing stolen data versus, you know, actual like the actual disruption impact that you see with ransomware too. Like, because you would think that, you know, with the disruption from ransomware that, you know, it would be like more impactful and, and people would be more willing to kind of do what the the threat actors are asking for. But it seems like these extortion model, you know, these extortion attacks are are pretty successful in that threat actors keep relying on them.

So, you know, I don't know if you know what kind of, you know, long term impact or like how how they're going to find keep finding success in these, but it's it's curious. I'm curious to like see kind of how this plays out. You know, and Clop also like they're pretty well known for like these like like wide-ranging sweeping attacks. Like they, they have targeted like manage file transfer platforms in the past and they found a lot of success in like targeting one specific platform, but like, and you know, kind of focusing on the breadth of all the customers within that platform. So I thought, you know, that's another kind of unique aspect of this as well.

And they've been quiet for a while, as we mentioned earlier. I, I really don't think I've heard their name in probably a couple of years, honestly. You know, they're, and Klopp is one of those weird sort of amorphous groups that's not just a ransomware group. Like they have affiliates and they did other things. It's not always just ransomware. They're associated with other cybercrime groups. You know, if I remember right, there were some takedowns or arrests of some Clop actors in the past, some disruptions of some of their infrastructure. I think I'd have to go back and look, but there's definitely been, there was some pretty serious security community and law enforcement attention on them in the, you know, probably the post COVID time frame is the best way I can describe it. But yeah, I, I honestly hadn't heard their name in a while. It was like, you know, I shit,

they're still around. OK, cool, great. Another thing to worry about. Well, then you've got this Crimson collective like Red Hat Group, which is the Red Hat incident, which is seems pretty new like I mean, I haven't heard of them at all, but. No, I have not heard of them at all until there was. I guess it was it was yesterday, it was Thursday or maybe even Wednesday.

Started seeing stories about some I I guess they're a new group. Crimson Dawn. I don't know what they're is it Crimson Dawn? Did I did I get it right or no? Crimson something Crimson Collective. Sorry. Crimson Dawn is like some Star Wars thing. I don't even know where my brain was going. I mean. That would be pretty cool. It would, it would not shock me at all, but they, I guess they in Red Hat has confirmed this that someone was able to breach a bunch of Red Hat GitHub repos. And what they were able to get among other things were some documents that are essentially like contracts, you know, because this, I think this is specifically related Red Hat consulting.

So, you know, consulting engagement agreements with customers, which you know sound like, oh, this is just a bunch of legalese, who really cares. But I have not seen one of these specifically. But if you're talking about security consulting engagement agreement with a customer, say any sort of enterprise that's going to involve not just the name of the company, but also the details of what you're going to do. Like we're going, OK, here's the infrastructure that we would. We will depending on what the scope of the engagement and everything like that.

It might name specifically what the products are, what the infrastructure that you're going to help them secure. It might also, and probably does, describe exactly what actions the consulting, the consultants will go in and do to help you secure whatever infrastructure it is or you know, whatever else it might be. But it's probably very detailed, and you know, that could be a very handy document for an attacker to have. Yeah, yeah, it's, it's interesting like that. And and by the way, I think initially reports said GitHub, but then they like.

I don't know if like Red Hat misspoke, but I guess it's actually Git lab. Instances. OK, maybe I misspoke. But they they ended like, I feel like they are like threat actors are like extremely strategic and kind of what they decide to target. And so like you said, like you would never think that something like that is going to be, you know, have much value. But if you look more deeply into, you know, what actually is there, Like I'd imagine there has to be a lot of back end research into something like that and kind of what kind of data, you know, these types of consultants might be, you know, looking at when they're working with customers.

And yeah, I mean, I think like I saw a report said they also like we're claiming they found like a off tokens and like other private information specifically in Red Hat code. So like pretty sensitive stuff like when it comes to kind of more of the downstream customer infrastructure. So so it's not great. And then also like we were talking about before too, this is like this is just another like extortion type of security, security incident.

So, you know, we're just seeing a lot of these. Yeah, it's, it's an interesting, I don't know if evolution is the right word, but kind of change of tactics for some of these groups. And I mean, again, this is not a group I'm familiar with in any way unless it's, you know, a group that changed their name, which happens all the time. But I, I was having a conversation yesterday with, you know, a couple of our friends who are offensive security researchers and I asked them, you know, what would the value of something like this be? And you know, it was kind of what I just described earlier. They were like, Oh my God, this would be, could be a road map based on, they were like based on my knowledge of what a consulting agreement would look like. This could be an absolute road map to the, to the customer organization.

You know, it might not really have network maps and network diagrams and those sorts of things. But for any attacker that understands the way that enterprise networks are set up, if it describes the products that they use, the cloud services that they use or things like that could be extremely valuable and could have very long term effects depending on how many of these things they got, who the victim organizations are, how old these engagement contracts are. You know, they didn't say if they were current, they could be 10 years old, who knows?

But as you said, this is kind of a a shift in the way that these guys are thinking. It's not just go in, exploit some bug, drop ransomware, ask for money, lather, rinse, repeat. It's there's some strategy behind this, You know, it's not just sort of spray and pray. Yeah, I almost feel like, like you see like the scattered spiders of the world and like, you know, other groups that are just being really innovative and how they're kind of approaching their their attacks. Like I think there is a bit of, you know, like, you know, different attackers looking into new ways that they can they can approach these types of things.

So. Yeah. I mean, they learn from each other the same way that defenders learn from each other. You know, they might not have big public conferences like, you know, like Black Hat and RSA, but they certainly share information and they all watch what each other are doing and what works and what doesn't work more importantly, and kind of go from there so that they're not ideally repeating mistakes. You know, and as everybody always says, attackers look for the path of least resistance, you know, like water flowing down a river, like it's going to go where the the resistance is is lowest.

So if ransomware defenses are getting better and things like that, they're going to look for these other ways in and other ways to monetize the access they have. Yeah, that's a really good point. Like I feel like whenever we introduce new ransomware protections or if there's not something, you know, new solutions or new tools or whatever, like I feel like one thing that the industry isn't doing enough is like saying, OK, we know the impact of this is that, you know, it's going to block threat actors or maybe it there'll be better monitoring or better, you know, response. But like, what then?

Like what, what's the next step for them? Like how can we be more proactive? Like ahead of how you know what their next move is? Because there will be a next move. Like they're not just going to stop. No, there's so much money to be made. And you know, if you want to really depress yourself sometime, go and look at some of the public photos that you know, security researchers or other threat and tell groups post sometimes of the ransomware actors that they track and like the the shit that those people post on.

Like they're literally like public Instagram accounts or in Telegram channels of them on some monster yacht in the Mediterranean or getting onto a private jet to fly to, you know, Rio or something. And these are the people that are doing this stuff. You know, there's so much money involved. And yes, we're making like incremental strides. And that's all great. But it's, it's a problem that's so big that there's no real way to get your arms or, you know, and nobody can describe the scope of it accurately. It's like the drug trade at this point, you can't really point to how big it is or who's in charge of what. It's just a bunch of opportunistic people making piles of money.

And it's depressing as hell. If you, if you really like sit and think about it, you're just like, at some point you're like, well, I can't think about that anymore. I have to go outside. Like literally I can't. Yeah. Yeah. As you say, touch grass. Yeah, Yep. Get out of here. Go. Yeah, turn your computer off and go outside and play with your dog. This is why I need to get a dog. Yeah, Oh yeah. Anyone in cybersecurity who works in this industry needs 100% needs a dog. I think This is why, like, yeah, a lot of our friends who are, you know, CSO's or have been at this a long time have like, multiple dogs or like, you know, they're just like all kinds of other hobbies like knitting or, you know, painting or something that absolutely focuses their mind on something other than, you know, yeah. Stupid computer stuff, Yeah.

Yeah, I have a theory that the longer you've been in in security, the more dogs or pets that you have just to make yourself feel better. I think you're entirely right. I don't know how I've survived this long without a dog, honestly. Yeah. It's not up to me though. It's not my decision, as you know. So, yeah, the, the last thing that we should probably talk about is some of the, there's some interesting and also kind of like a little bit depressing federal government related news, not specifically related to the the government shutdown that happened this week, but sort of tangential 2 things happen. One is there was a law that was enacted in 2015 and it's got a confusing acronym, which is SISA. It is not the law that created the, you know, Cybersecurity Infrastructure Security Agency that we all know. It's the Information Sharing Act

that provides legal protections for organizations to to essentially share threat and tell with the federal government and vice versa. Like two way sharing of, you know, all that public private partnership that we've all been talking about for 25 years. It's a law that kind of codified that in 2015. It expired on September 30th, which was three days ago, yeah, three days ago. And so that's not great. There are still ad hoc ways for this to happen and safe harbor protections in some areas.

But the fact that the overarching legislation that made this a thing expired without any extension or there were efforts leading up to this to, you know, essentially amend it or create a new law that did the same thing but did some other things. But Washington being Washington, it didn't happen because there was other things also not happening, like budgets not being passed. So that's not ideal. And at the same time the MSI SAC, which is the multi state ISAC, which is kind of the big overarching information sharing center, it didn't expire, but the the federal system essentially said we're not, we're not doing this anymore. Like there's other ways that we can get this done. There's going to be sort of a fee based program for this from what I read in one article.

But this seems like, I don't know if systematic is the right word, but semi systematic way of like just eliminating a lot of information sharing and threatened to going back and forth, which is one of the things that the government actually did right? Like that was a net positive. So I, I don't really know what else to say about it, but like, it's just a little bit upsetting that this stuff is not at least formalized in the way that it was before.

Yeah, I'm, you know, I, I would be curious to see what the the impact is going to be from, you know, especially from the, the CISA 1 not. Yeah, I know. Cyber security, Infrastructure security, like I'd imagine that's going to lead to a bit more of a pause from companies when they're thinking of sharing information or at least slow things down because, you know, at that point, like maybe they need to bring in their legal teams honestly, or like, you know, think about what, what the, what it could possibly mean in terms of like a lack of protection.

So, you know, I'd imagine it's going to kind of slow down that, that whole process if the, if there are, you know, threats that they, they want to share to the government. So, you know, I, I'm sure I did see like some like some conversations about people wondering if, you know, this isn't going to be forever like, and maybe that it'll be brought back in the future. I guess it's just a question of when you know, like that could be.

That seems likely. But yes, we don't have a functioning federal government right now. That's not hyperbole. Like the government is not working right now. And so there's nothing like there. There's no short term answer for this, unfortunately. And as, as you said, like for people that weren't around or don't remember, like it took so long to get private companies comfortable with sharing any of this information with the federal government. Like it took a literally a law that provided, you know, legal protections for it. You know, 15 years ago, nobody wanted to do this and they were not doing it.

They would do it maybe on an ad hoc basis, but they were not sharing very specific attack information, IO, CS, any of that kind of stuff with the federal government because there was no, what's the upside? It didn't help them. You know, the private sector had better incident response capabilities then. They had better information then. So there was really no benefit to sharing that information with the federal government. That's changed in a lot of ways. But this, this expiring in the MSI SAC sort of like being defunded or whatever the right phrase is, is, you know, walking that back quite a bit and it's not, it's not a positive sign. Yeah, I think even like, yeah, a couple of years ago, like the the government was making a really big push for trying to, I mean, honestly, right until up until this was trying to make a really big push to kind of branch that public private sector collaboration.

And I know, like when I was writing about CERSEA and some of these other things in the past about like, there was a lot of, you know, the, I would say the US government was really explicit previously about what it meant if companies shared information with it. Like, I know they said like, hey, they would point to specific examples and be like, this company shared about an incident that happened with us or like a threat. And here's how we then use that information to track down the threat actors and like help them return their, their money or get their ransom payment back or things like that. Or if you look at the like, no, an exploited vulnerabilities catalog, like, you know, that we have a lot of different things that are happening in the background to kind of help the, the CISA and the government like better understand the threats and how vulnerabilities are being exploited and all this, this different, these different

pieces. So it, like you said it, it's upsetting that, you know, this is kind of being abandoned right now. And so I, yeah, I hopefully that doesn't have any kind of longer term implications about what that relationship is between the public and private sector, but I will see. I mean, I don't know how much of this is sort of just like the walk back nonsense that happens when administrations change. Like, you know, a lot of the stuff that you just described was the work done by Sisa under Jen Easterly, who, you know, left a few months ago and was a huge proponent of, you know, we make fun of the public private partnership phrase. But she was literally out there doing that stuff and actually creating ways for this to work.

You know, I think of that JCDC effort that that she launched, I don't know, probably two years ago now, maybe more, all these information sharing things. And you mentioned that the Kev catalog, which is a great example. You know, a lot of the information, if you go and look at those entries, yes, some of them, the information came from incident response stuff that CISA did or you know, DoD did or other government agencies did. But a lot of it comes from private sector notifications of, hey, we've seen this exploited in the wild. And I don't know exactly how all that works, but I don't know. This can't be a benefit for those efforts. You know, it's, it's certainly not going to help. So yeah, I mean, I don't want to sound like a doomsayer, but it took a lot of work to get those things done in the 1st place, and letting them kind of die on the vine now is certainly not helpful to anybody.

And starting from scratch, depending on how long these things are not, not around, you know, if there's a 2 month gap or a six month gap or however long it takes to get something else up and running, you know, that's those can be, you know, a 2 month, two months in cybersecurity is like light years. You know, God only knows what happens in two months. Right, yeah, and the the MSI sack thing too. I think you know, you talk when you're talking about Jenny's for like like she did a lot there as well. I'm looking at kind of honestly like, yes, the state local governments, but like kind of these smaller, you know, smaller org, smaller entities that maybe are in areas where they're not getting as many resources.

And you know, I think it's not explicitly mentioned a lot of the times, but like this is that's critical infrastructure. If we're like thinking about critical infrastructure and there's a lot of focus and priority on that by the US government right now for security. Like it's those types of works that are, you know, making up kind of the backbone of the US that really need to be protected because they they don't have those resources. So, so I think that that was, you know, for me kind of what what I was reading between the lines when I looked at that that news. That's actually somebody mentioned that specifically to mainland's is the state local and tribal and territorial government piece of that is, you know, those are the people that are probably going to be hurt the most with something like this.

You know, large enterprises like they have ways of getting this in from, you know, it's not vital to them. You know, some giant financial company doesn't need to participate in Isaac to understand what the threat landscape is. But, you know, a state government in Idaho that maybe has a security person, you know, they kind of rely on that. Yeah, like singular and probably doesn't probably has, you know, a network engineer who also is responsible for security and onboarding and offboarding and all that kind of good stuff. In relies on reports from an ISAC or, you know, now is going to have to be on, you know, Reddit boards trying to find out what the Hell's happening with, you know, say an Oracle extortion campaign or something like that. So you know, it's it's not ideal. No, Yeah.

Well, hopefully, you know, when we do our next news podcast, like maybe you know, at least for the the information sharing act like maybe we'll have some better news about that. That would be great, Yeah. And maybe I'll have a dog by then, but I don't. I don't think so. I don't know which one's more likely. Actually, I do know because I'm never getting a dog. So yeah. Oh well, maybe we'll do a weekly update. Does Dennis have a dog yet?

Yeah, every time I'll bring my dog on and then maybe that'll like start convincing. You know what the blocker is, and it's, yeah, it's not changing. But yeah, you bringing your dog on would only make it more upsetting for me, honestly. But that's OK. That's all right. All right. Well, it's good to see you. And yeah, as, as we mentioned at the top, if you want to come check out the War Games Security Theatre event in November in New York City, we would love to see you. Go check out the link that will be in the show notes. Or you can use the Google Machine to find it. It'll be a lot of fun.

There's going to be a lot of cool stuff happening there, so have a look. Awesome. All right, Lindsay, have a good weekend. Talk to you soon. Bye.