Cybersecurity experts have uncovered a sophisticated attack technique that leverages Oracle’s database software to gain unauthorized access to Windows systems. The exploit, which involves compiling a malicious “khunt” inside the Oracle database, has been used in real-world attacks to breach even the most secure networks.
The attackers behind this campaign appear to be highly skilled and organized, with multiple victims already identified across various industries. One of the affected organizations is a major financial institution, where the attackers were able to gain SYSTEM-level access to Windows servers using the compromised Oracle database as a stepping stone. This access enabled them to move laterally within the network, exfiltrating sensitive data and potentially causing further damage.
So how does this exploit work? The khunt – short for “kernel hunt” – is a type of malware that specifically targets the Oracle database’s stored procedures. These procedures are essentially scripts that automate tasks within the database, allowing developers to streamline complex operations. However, by injecting malicious code into these procedures, attackers can create a backdoor into the database, which they can then use to pivot and gain access to adjacent systems.
What makes this exploit particularly concerning is its ability to bypass traditional security controls. Since the khunt malware resides within the Oracle database itself, it can evade detection by network-based intrusion prevention systems (IPS) or host-based antivirus software. Moreover, because the exploit relies on the inherent privileges granted to database administrators, attackers can move undetected through the network, even if they don’t possess any prior knowledge of the system’s configuration.
The implications of this discovery are far-reaching, as it highlights a critical vulnerability in enterprise environments that rely heavily on Oracle databases. While organizations have long been aware of the risks associated with SQL injection attacks, this exploit demonstrates how an attacker can turn such an attack into a full-blown Windows SYSTEM access breach. This emphasizes the need for enhanced security measures, including regular patching and vulnerability scanning, as well as thorough training programs for database administrators to prevent similar exploits in the future.
To protect your organization from this type of attack, it’s essential to implement robust defense strategies that focus on detecting and preventing lateral movement within the network. Regularly review and update access controls, limit user privileges, and deploy an intrusion detection system (IDS) capable of monitoring database activity for suspicious patterns. By taking proactive steps to address these vulnerabilities, organizations can minimize their exposure to such attacks and safeguard against potential data breaches.
Source: The Hacker News — 2026-08-06