This Week in Cybersecurity (2025-12-02): Enterprise Cybersecurity Threat Intelligence

Enterprise Cybersecurity

Enterprise Lens

This week highlights a significant increase in ERP/identity-driven extortion, critical communications ransomware, and AI analytics data compromise.

• CL0P Oracle EBS zero-day exploitation affecting ~30+ organizations, including large universities and service providers.

• Crisis24 / CodeRED emergency alert outages demonstrate an increased risk in public infrastructure dependencies.

• OpenAI / Mixpanel breach shows that analytics chains are now part of the enterprise attack surface.

• CISA KEV updates emphasize ongoing exploitation of ICS/SCADA and enterprise software.

Enterprise Relevant Threats

ERP / Identity Attack Patterns

• Oracle EBS zero-day (CVE-2025-61882) is being operationalized by CL0P for large-scale, high-volume exfiltration events.

Critical Infrastructure Exposure

• Ransomware affecting emergency alert systems shows attackers targeting trust infrastructure.

SaaS Supply Chain Weakness

• Salesforce cross-tenant exposure indicates widespread risk from “connector SaaS.”

  
  

Enterprise Action Items

Immediate

• Patch Oracle EBS, Chrome, 7-Zip, Microsoft KEV items.

• Validate SOC monitoring for ERP / IAM exfiltration patterns.

Strategic

• Strengthen identity governance (PAM, passwordless roadmap).

• Expand SaaS supply-chain governance.

• Conduct ransomware double-extortion exercises.