₦airaland Forum

A threat actor has targeted the login infrastructure of Oracle Cloud, exploiting middleware vulnerability, and demanding ransom from over 140,000 tenants.

A threat actor has reportedly breached Oracle Cloud infrastructure, exfiltrating six million sensitive authentication records and potentially endangering more than 140,000 enterprise customers. The attacker is now demanding ransom payments while actively marketing the stolen data on underground forums, according to threat intelligence firm CloudSEK.

Security researchers at CloudSEK’s XVigil team discovered the breach on March 21, 2025, when they identified a threat actor operating under the alias “rose87168” selling millions of records extracted from Oracle Cloud’s Single Sign-On (SSO) and Lightweight Directory Access Protocol (LDAP) systems.

The compromised data includes critical security components such as Java KeyStore (JKS) files, encrypted SSO passwords, key files, and Enterprise Manager Java Platform Security (JPS) keys – all essential elements for authentication and access control within the Oracle Cloud environment.

According to CloudSEK’s investigation, the attacker claims to have penetrated Oracle’s infrastructure by exploiting a vulnerability in the company’s login endpoints, specifically targeting the subdomain login.us2.oraclecloud.com. This subdomain was reportedly still operational as recently as February 17, 2025, despite running severely outdated software components.

“The threat actor has demonstrated sophisticated capabilities by targeting a critical authentication infrastructure,” said CloudSEK in their report. “They’re not only selling the data but also actively recruiting assistance to decrypt the stolen passwords, suggesting an organized and persistent threat operation.”

Oracle has denied the data breach. “There has been no breach of Oracle Cloud. The published credentials are not for the Oracle Cloud. No Oracle Cloud customers experienced a breach or lost any data,” an Oracle spokesperson said.

Russia or North Korea.

Flangelo12:
Russia or North Korea.

What makes you think so??

When "yahoo boys" scams foreign nationals is it appropriate to say Nigeria or Nigeria government scammed them??

preciouswoman66:
What makes you think so??

When "yahoo boys" scams foreign nationals is it appropriate to say Nigeria or Nigeria government scammed them??

That's what they say about Nigeria.

MindHacker9009:
A threat actor has targeted the login infrastructure of Oracle Cloud, exploiting middleware vulnerability, and demanding ransom from over 140,000 tenants.

A threat actor has reportedly breached Oracle Cloud infrastructure, exfiltrating six million sensitive authentication records and potentially endangering more than 140,000 enterprise customers. The attacker is now demanding ransom payments while actively marketing the stolen data on underground forums, according to threat intelligence firm CloudSEK.

Security researchers at CloudSEK’s XVigil team discovered the breach on March 21, 2025, when they identified a threat actor operating under the alias “rose87168” selling millions of records extracted from Oracle Cloud’s Single Sign-On (SSO) and Lightweight Directory Access Protocol (LDAP) systems.

The compromised data includes critical security components such as Java KeyStore (JKS) files, encrypted SSO passwords, key files, and Enterprise Manager Java Platform Security (JPS) keys – all essential elements for authentication and access control within the Oracle Cloud environment.

According to CloudSEK’s investigation, the attacker claims to have penetrated Oracle’s infrastructure by exploiting a vulnerability in the company’s login endpoints, specifically targeting the subdomain login.us2.oraclecloud.com. This subdomain was reportedly still operational as recently as February 17, 2025, despite running severely outdated software components.

“The threat actor has demonstrated sophisticated capabilities by targeting a critical authentication infrastructure,” said CloudSEK in their report. “They’re not only selling the data but also actively recruiting assistance to decrypt the stolen passwords, suggesting an organized and persistent threat operation.”

Oracle has denied the data breach. “There has been no breach of Oracle Cloud. The published credentials are not for the Oracle Cloud. No Oracle Cloud customers experienced a breach or lost any data,” an Oracle spokesperson said.

Dem better denial cause be like say dem go fine dem

That's if the researcher is right sha

Flangelo12:
That's what they say about Nigeria.

False! They don't say Nigeria or Nigeria government but rather Nigeria national or Nigerian

preciouswoman66:
False! They don't say Nigeria or Nigeria government but rather Nigeria national or Nigerian

Not true.

They say those Nigerians.

preciouswoman66:
Dem better denial cause be like say dem go fine dem

That's if the researcher is right sha

Their fine will now be bigger for their denial!