Oracle E-Business Suite (EBS) Targeted in Coordinated Intrusion Campaign

ERP Systems Remain a High-Value Objective for Financially Motivated and Ransomware Operators

Executive Summary

In November 2025, multiple enterprise breach investigations identified Oracle E-Business Suite (EBS) as a deliberate and repeated intrusion target. Analysis of affected environments indicates structured exploitation of exposed Oracle EBS web tiers, credential harvesting activity, post-authentication abuse of application framework components, and database-layer privilege escalation.

The campaign reflects a broader trend: attackers are increasingly pivoting toward ERP systems due to their centralized control over financial operations, vendor payment workflows, HR data, and supply chain management. Successful compromise provides both immediate monetization opportunities and strategic leverage in extortion scenarios.

Observed tradecraft suggests a financially motivated intrusion set with ransomware enablement objectives, though elements of activity overlap with known initial-access broker behaviors.

Affected Technology

Oracle E-Business Suite (EBS) 12.1.x and 12.2.x
Oracle HTTP Server (OHS) components
WebLogic-managed application tiers
Oracle Database back-end systems
Integrated Single Sign-On (SSO) implementations

Attack Overview

Initial Access

Attackers primarily targeted:

Internet-exposed /OA_HTML/ and /forms/frmservlet endpoints
Unpatched web-tier vulnerabilities
Weak authentication controls (no MFA on financial roles)
Legacy SSO integrations

In multiple cases, attackers leveraged credential spraying against exposed login portals, followed by exploitation of known web-tier vulnerabilities in environments lacking recent Critical Patch Updates (CPUs).

Post-Authentication Activity

Once authenticated, actors:

Queried application metadata tables for role enumeration
Enumerated financial responsibility assignments
Accessed AP/AR modules
Extracted vendor banking details
Attempted privilege escalation within FND_USER and FND_RESPONSIBILITY tables
Pivoted toward database server OS-level access

Several victims reported staged data exfiltration prior to ransomware deployment.

Technical Indicators of Compromise (IOCs)

Suspicious URLs Observed

/OA_HTML/OA.jsp?OAFunc=OAHOMEPAGE
/OA_HTML/AppsLogin
/forms/frmservlet?config=
/OA_HTML/RF.jsp

High-frequency POST activity from single IPs against login endpoints was observed.

Example Malicious IP Addresses

185.225.69.42
45.95.147.201
193.142.146.78
91.219.236.113

Behavior:

Repeated authentication attempts
POST flood to /OA_HTML/AppsLogin
Access to /OA_HTML/RF.jsp post-login

Suspicious User Agents

Mozilla/5.0 (Windows NT 10.0; Win64; x64) EBS-Client
python-requests/2.31.0
curl/7.88.1

Database-Level Indicators

Unusual queries against:

FND_USER
FND_RESPONSIBILITY
FND_USER_RESP_GROUPS_DIRECT
AP_SUPPLIERS
AP_SUPPLIER_SITES_ALL
IBY_EXT_BANK_ACCOUNTS

Indicators include:

Large-volume SELECT statements outside standard reporting windows
New responsibility assignments to privileged roles
Sudden changes to AP_SUPPLIER payment data

Suspicious File Artifacts

Observed in compromised web tiers:

/tmp/.ebs_patch.log
/u01/install/.cache.jsp
/u01/tmp/healthcheck.jsp

Example Web Shell Indicators

Injected JSP web shells placed within:

$EBS_DOMAIN_HOME/servers/OA_HTML/tmp/_pages/

MITRE ATT&CK Mapping

Tactic	Technique
Initial Access	T1190 – Exploit Public-Facing Application
Credential Access	T1110 – Brute Force
Persistence	T1505.003 – Web Shell
Privilege Escalation	T1068 – Exploitation for Privilege Escalation
Discovery	T1087 – Account Discovery
Collection	T1213 – Data from Information Repositories
Exfiltration	T1041 – Exfiltration Over C2 Channel
Impact	T1486 – Data Encrypted for Impact

Observed Kill Chain Progression

Recon of exposed Oracle EBS login portals
Credential spraying or exploitation
Application responsibility enumeration
Financial data access
Database pivot
Data exfiltration
Ransomware deployment (in select cases)

Detection Guidance

Web Layer

Alert on repeated POSTs to /OA_HTML/AppsLogin
Monitor anomalous access to /RF.jsp
Identify logins outside business hours from foreign IP ranges

Database Layer

Monitor:
- Privileged responsibility changes
- Large AP_SUPPLIER table exports
- Unscheduled FND_USER modifications

Network Layer

Flag outbound connections from DB tier to untrusted IP space
Inspect for abnormal TLS egress patterns

Risk Assessment

ERP systems represent:

High financial leverage
Centralized identity and privilege control
Direct wire-transfer manipulation potential
High extortion value due to business disruption impact

Unlike traditional file servers, Oracle EBS compromises can immediately affect:

Payroll
Vendor payments
Inventory management
Regulatory reporting

Remediation Recommendations

Apply latest Oracle Critical Patch Updates immediately
Remove direct internet exposure of EBS where possible
Enforce MFA for all financial and SYSADMIN roles
Audit custom responsibilities and inactive accounts
Restrict database access via segmentation
Implement WAF rules specific to Oracle EBS endpoints
Conduct compromise assessment focusing on:
- FND tables
- Vendor banking modifications
- Web-tier file integrity

Strategic Assessment

The November 2025 activity demonstrates that ERP platforms remain a prime objective for financially motivated threat actors. As perimeter security improves, attackers are shifting focus to high-impact business logic systems.

Organizations treating ERP platforms as “internal business systems” rather than critical security assets face elevated risk. Oracle EBS environments require the same defensive rigor as externally exposed applications.