Executive Summary
On 21 March 2025, CloudSEK’s XVigil discovered a threat actor, "rose87168," selling 6M records exfiltrated from SSO and LDAP of Oracle Cloud. The data includes JKS files, encrypted SSO passwords, key files, and enterprise manager JPS keys.
The attacker, active since January 2025, is incentivizing decryption assistance and demanding payment for data removal from over 140K affected tenants. Our engagement with the threat actor suggests a possible undisclosed vulnerability on login.(region-name).oraclecloud.com, leading to unauthorized access. While the threat actor has no prior history, their methods indicate high sophistication, CloudSEK assesses this threat with medium confidence and rates it as High in severity.
Analysis and Attribution
Information from the Post
CloudSEK's XVigil discovered threat actor "rose87168" selling 6 million records extracted from Oracle Cloud's SSO and LDAP on March 21, 2025. The threat actor claims to have gained access by hacking the login endpoint: login.(region-name).oraclecloud.com.
- The database includes:
- ~6 million lines of data dumped from Oracle Cloud’s SSO and LDAP that include
- JKS files,
- encrypted SSO passwords,
- key files,
- enterprise manager JPS keys.
- ~6 million lines of data dumped from Oracle Cloud’s SSO and LDAP that include
- Additionally, the threat actor offered an incentive to anyone that helped them decrypt the SSO passwords, and/or crack the LDAP passwords.
- The list of affected tenants is over 140k, and the threat actor is urging companies to contact them and pay a certain “fee” to get their data removed.
- The threat actor also created an X page and started following Oracle related pages.
- As the threat actor seems to have exploited a web application vulnerability, we started looking at the webservers being used for oraclecloud login pages. We noticed that most of the oracle cloud login pages were showing the favicon for oracle web logic server.
- Based on the available information, it can be ascertained with medium confidence that the threat actor used an undisclosed vulnerability on Oracle WebLogic servers used for hosting the login pages for oraclecloud.com. By exploiting login endpoints for all regions, the threat actor was subsequently able to dump data pertaining to the underlying tenants.
Threat Actor Activity and Rating
Impact
- Mass Data Exposure: Compromise of 6M records, including sensitive authentication-related data, increases risks of unauthorized access and corporate espionage.
- Credential Compromise: Encrypted SSO and LDAP passwords, if cracked, could enable further breaches across Oracle Cloud environments.
- Extortion & Ransom Demands: Threat actor is coercing affected companies to pay for data removal, increasing financial and reputational risks.
- Zero-Day Exploitation: The suspected use of a zero-day vulnerability raises concerns about Oracle Cloud security and potential future attacks.
- Supply Chain Risks: Exposure of JKS and key files may enable attackers to pivot and compromise multiple interconnected enterprise systems.
Mitigation
- Immediate Credential Rotation: Change all SSO, LDAP, and associated credentials, ensuring strong password policies and MFA enforcement.
- Incident Response & Forensics: Conduct a thorough investigation to identify potential unauthorized access and mitigate further risks.
- Threat Intelligence Monitoring: Continuously track dark web and threat actor forums for discussions related to the leaked data.
- Engage with Oracle Security: Report the incident to Oracle for verification of a potential zero-day and seek patches or mitigations.
- Strengthen Access Controls: Implement strict access policies, least privilege principles, and enhanced logging to detect anomalies.
References
#Traffic Light Protocol - Wikipedia