Executive Summary
In late July 2026, researchers identified a sophisticated attack against an Oracle database server that originated from a classic SQL injection vulnerability in a public-facing Tomcat application. After gaining initial access via the JDBC connection, the threat actor deployed a novel post-exploitation toolkit named 'khunt' directly into the database schema using Oracle's 'CREATE JAVA SOURCE' functionality.
The khunt toolkit consists of several modules—including KhuntCmd, KhuntHash, and KhuntFS—that allow for OS-level command execution, credential harvesting from internal Oracle tables, and file system manipulation. This approach is particularly effective as it bypasses traditional EDR and AV solutions that primarily monitor OS-level processes and files rather than malicious Java classes stored within a database engine.
The impact of this campaign is high, as the attackers successfully escalated privileges to SYSTEM and attempted to exfiltrate critical Windows registry hives (SAM, SECURITY, and SYSTEM). This incident highlights the ongoing risk of SQL injection and the evolution of database-resident malware that can serve as a persistent beachhead for broader network compromise.