Particle.news

Attackers Implant khunt Toolkit Inside Oracle Database Via SQL Injection

Huntress says attackers abused Oracle’s CREATE JAVA SOURCE to run operating-system commands from within the DBMS, a technique that can bypass endpoint-focused defenses.

Overview

  • Huntress discovered the intrusion on July 27, 2026 and published detailed technical findings on August 5, 2026 that trace the attack from a public web form to an Oracle server.
  • The initial foothold came from a classic SQL injection in a Tomcat-hosted autocomplete search feature that failed to validate user input, letting attackers submit malicious SQL to the backend.
  • Attackers used CREATE JAVA SOURCE to upload and compile a custom toolkit called khunt as Java objects and PL/SQL wrappers inside Oracle, turning the database into an active attack platform.
  • khunt included modules to run OS commands, read Oracle user tables, browse and manage files, and unzip archives; operators used it to run whoami as SYSTEM and copy the Windows SAM, SECURITY and SYSTEM registry hives.
  • Huntress warns this approach creates a blind spot for many endpoint tools and recommends input sanitization, removing CREATE JAVA SOURCE/exec privileges from app accounts, auditing DB objects, and adding database-aware detection.