Cybersecurity researchers have discovered a highly unusual attack where hackers exploited a SQL injection vulnerability to install a post-exploitation toolkit directly inside an Oracle database. The toolkit, named 'khunt', allows attackers to execute operating system commands, steal credentials, and browse files with SYSTEM-level permissions.
Key Takeaways
- Hackers exploited a SQL injection vulnerability in a public-facing Java application running Apache Tomcat.
- The 'khunt' toolkit was compiled and stored directly inside the Oracle database as Java Virtual Machine (JVM) objects.
- The attackers achieved SYSTEM-level privileges on the host Windows server, enabling credential theft.
Huntress security researchers recently uncovered a sophisticated cyberattack wherein threat actors bypassed traditional detection mechanisms by embedding malware directly inside an Oracle database. The intrusion, detected on July 27, 2026, began with the exploitation of a SQL injection vulnerability in a public-facing Java application running on Apache Tomcat. Specifically, a vulnerable autocomplete search feature failed to validate user inputs, allowing attackers to execute unauthorized SQL commands.
Once inside, the attackers took an unconventional route. Instead of deploying malicious executable files directly onto the server's file system—which would easily trigger Endpoint Detection and Response (EDR) alerts—they utilized Oracle's embedded Java Virtual Machine (JVM). By using the CREATE JAVA SOURCE statement, they compiled and stored a modular post-exploitation toolkit named khunt directly inside the database as schema objects. These objects were then executed via SQL commands to run operating system-level tasks.
Why This Matters
BozokMedia analysis shows that fileless database-resident malware represents a highly evasive evolution in cyber espionage. By operating entirely within the database's memory and JVM environment, hackers can easily bypass traditional security agents that only monitor disk activity and standard operating system processes.
"The abuse of Oracle's built-in Java capabilities to run OS commands is rarely documented in the wild, making this a highly sophisticated evasion technique that highlights the critical need for database-level monitoring," noted a senior security researcher at Huntress.
| Component | Functionality |
|---|---|
| KhuntCmd | Executes OS commands via cmd.exe |
| KhuntHash | Extracts Oracle usernames and password hashes |
| KhuntFS / KhuntFS2 | Enables file browsing, reading, and searching |
| KhuntUnzip | Extracts compressed files on the target system |
Using the KhuntCmd component, the attackers executed the whoami command, confirming they possessed SYSTEM-level privileges on the underlying Windows server. This high level of access allowed them to copy critical registry hives, including SAM, SECURITY, and SYSTEM, using standard Windows utilities and PowerShell. These files contain local Windows account password hashes, which the attackers likely exfiltrated for offline credential cracking.
To mitigate such highly evasive attacks, organizations must implement strict input validation and sanitize all user-supplied data. Furthermore, database accounts used by public-facing applications should adhere to the principle of least privilege. These accounts must never be granted administrative permissions, such as the ability to create Java sources or execute unauthorized stored procedures.
Frequently Asked Questions
Q1: What is the 'khunt' toolkit?
A1: It is a post-exploitation toolkit written in Java and PL/SQL that allows attackers to execute OS commands, steal credentials, and manage files directly through an Oracle database.
Q2: How can organizations protect against this database exploit?
A2: Organizations should sanitize all user inputs to prevent SQL injection, restrict database privileges for web applications, and monitor Oracle JVM activities for unauthorized executions.
