Oracle zero-day vulnerabilities are being targeted by at least one major cybercrime group and the FBI says it's looking bad.