Cl0p Ransomware Hits 50 Global Giants Again: Shell 89GB Stolen, Suspected Oracle E-Business Suite 0day
Cl0p claimed on August 13 it breached Shell, Philips, GE, Fiserv and ~50 global firms. Shell: 89GB engineering drawings. Philips: 13.5GB blueprints. Suspected entry: unnumbered Oracle E-Business Suite zero-day.
Russia-nexus Cl0p ransomware group posted a new victim list on its dark-web leak site on August 13, claiming large-scale data theft from Shell, Philips, GE, payment firm Fiserv and nearly 50 global enterprises. Cl0p self-reported 89GB of engineering drawings, facility images and project plans from Shell, and ~13.5GB of design blueprints from Philips. Multiple researchers tie this wave to an unpatched, unnumbered Oracle E-Business Suite zero-day — a single-vuln mass harvest, highly similar to the 2023 MOVEit campaign.
Event Overview
Cryptonomist reported on August 14 that Cl0p updated its dark-web leak site with new victims including Royal Dutch Shell, Royal Philips, GE and Fiserv, claiming nearly 50 firms total. Cl0p claimed 89GB from Shell (technical drawings, facility images, scanned test reports, internal project plans) and ~13.5GB from Philips (primarily design drawings and blueprints). GE and Fiserv theft details are unpublished. Shell said it is aware of a potential incident and opened an investigation. Philips said the attack targeted a specific server holding internal data; the incident is contained and did not affect customer environments.
Technical Details
Cl0p's 2026 activity continues its signature pure data-theft extortion: no file encryption, no system destruction — silent copy, then leak-as-leverage. SecurityScorecard, Cybersecurity Help and others map this wave to an Oracle E-Business Suite (EBS) zero-day. Oracle EBS is widely deployed for finance, procurement, HR and operations; Fortune 500 usage is heavy. A single vuln can harvest dozens of blue-chip firms — same technical logic as Cl0p's 2023 MOVEit breakout. Hendry Adrian's ATT&CK analysis frames Cl0p as an internet-exposed MFT/enterprise-app zero-day harvester; seven of nine known operations deployed novel vulns. Patterned 0day use is a core capability.
Impact Assessment
Cl0p's extortion rests on leak pressure, not encryption recovery cost. Shell, Philips and peers cannot buy silence by restoring stolen data. 89GB of Shell engineering data in competitor hands hits bid strategy and technical roadmaps. Philips 13.5GB blueprints, if medical-device line, trigger EU MDR and US FDA dual disclosure. Cl0p published Shell data after non-payment in the 2023 MOVEit incident; the loud-announce-then-negotiate script is reusable. Firms not yet listed but running Oracle EBS face the 0day window as primary risk — once patches and PoCs drop, attackers expand scan surface immediately.
Remediation
- Inventory all internet-exposed Oracle E-Business Suite instances; identify patch status and open ports;
- Monitor Oracle Critical Patch Update advisories and the CISA KEV catalog; prioritize new EBS CVEs;
- WAF allowlist Oracle EBS admin and business interfaces: trusted source IPs and required paths only;
- Retain EBS application logs and database access logs 6–12 months for forensics and regulatory requirements;
- SIEM alert on Cl0p-associated infrastructure (45.129.137.232, 92.118.36.233, 200.107.207.26 and related scan ranges);
- Enable MFA on EBS user accounts; disable shared service accounts.
References
- Cryptonomist: Cl0p Ransomware Attack Hits Shell, Philips, GE, Claims 50 Firms Breached
- BeyondMachines: Anywhere Real Estate Data Breach via Oracle EBS Zero-Day
- Hendry Adrian: Cl0p Ransomware — Attack Pattern in Threat Intelligence
- Cybersecurity Help: Cyber Security Week in Review — August 14, 2026