15th October 2025 Cyber Update: Harvard Confirms Breach in Major Oracle Zero-Day Attack

The Update: A Harvard University Information Technology spokesperson confirmed that while the university was affected, the breach impacted only “a limited number of parties associated with a small administrative unit.” The spokesperson said there is “no evidence of compromise to other University systems” and confirmed that a patch has been applied.

The incident aligns with a global exploitation campaign tracked by Google’s Threat Intelligence Group and Mandiant, which found more than 100 organisations had been targeted since at least July 2025. Security firms including CrowdStrike have reported that attacks began in mid-2025, coinciding with a wave of extortion attempts sent to executives. Oracle acknowledged the campaign on 2 October, confirming that vulnerabilities in EBS had been fixed in earlier updates. A follow-up advisory urged all users running Oracle EBS versions 12.2.3 through 12.2.14 to install the latest patches.

The vulnerability, tracked as CVE-2025-61882, was added to the U.S. Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog on 6 October, confirming active exploitation by threat actors. Analysis from Google revealed that the attackers deployed Java-based implants to extract data from EBS environments while avoiding detection.

While Harvard was named on Cl0p’s dark web site, the group has not released any data, and no ransom demands or confirmed data publications have been reported by Harvard, Oracle, or the involved cybersecurity firms. The investigation remains ongoing.

Why It Matters: This case underscores the global reach and sophistication of the Cl0p group, which has a history of exploiting enterprise software vulnerabilities to launch large-scale extortion campaigns. The exploitation of Oracle’s EBS, a critical platform for managing sensitive corporate and institutional data, demonstrates the increasing risk posed by supply chain and software-layer vulnerabilities.

Harvard’s limited exposure is notable, but the broader campaign highlights how a single unpatched flaw in widely used enterprise systems can trigger cascading consequences across sectors. The attack reinforces the importance of continuous patch management, proactive threat monitoring, and coordination between software vendors and customers to close security gaps before adversaries can exploit them.