Cyberattackers have successfully installed a post-exploitation toolkit, known as khunt, directly inside an Oracle database used to breach a corporate network. The attack was discovered by Huntress on July 27, 2026, after its security platform detected credential theft on a server hosting the Oracle database server.
The attackers exploited a SQL injection vulnerability in a public-facing Java application running Apache Tomcat. Specifically, they targeted an autocomplete search feature that allowed them to issue SQL commands to the Oracle database. The malicious requests were traced back to the IP address 178.162.151[.]229. Once inside the database, the attackers installed khunt as a Java object using Oracle’s embedded Java Virtual Machine and CREATE JAVA SOURCE statement.
This allows Java source code to be stored and compiled as a database schema object, which can then be executed via SQL commands. The attackers abused this functionality to compile and store the khunt toolkit directly inside the Oracle database rather than deploying it as an executable file on the server. As Huntress noted, “The use of this technique in the wild has rarely been documented.”
The khunt toolkit contains multiple Java components and PL/SQL wrappers that can execute commands, steal credentials, and manage files. These components include tools to launch operating system commands through SQL statements, access Oracle’s internal user table, read and write file data, and extract compressed files.
The attackers used the khuntCmd tool to run cmd.exe /c whoami, confirming that commands executed through the Oracle database had SYSTEM-level permissions on the Windows server. They then used PowerShell and Windows utilities to copy sensitive registry hives, which can be used to recover password hashes for local Windows accounts.
As a result of this attack, it’s clear that organizations need to take extra precautions to secure their databases and public-facing applications. Huntress recommends that database accounts used in these applications should not have high enough privileges to create Java sources, execute unnecessary stored procedures, or perform other administrative actions. Additionally, all user-supplied input should be thoroughly sanitized and validated.
This incident serves as a reminder of the importance of robust security measures and ongoing monitoring of network activity. It’s essential for organizations to regularly test their defenses against potential threats, including conducting breach and attack simulation tests to identify vulnerabilities in their systems. By taking proactive steps to secure their networks and databases, organizations can reduce the risk of falling victim to similar attacks in the future.
Source: Bleeping Computer — 2026-08-05