Overview
- Huntress discovered the intrusion on July 27, 2026 and published detailed technical findings on August 5, 2026 that trace the attack from a public web form to an Oracle server.
- The initial foothold came from a classic SQL injection in a Tomcat-hosted autocomplete search feature that failed to validate user input, letting attackers submit malicious SQL to the backend.
- Attackers used CREATE JAVA SOURCE to upload and compile a custom toolkit called khunt as Java objects and PL/SQL wrappers inside Oracle, turning the database into an active attack platform.
- khunt included modules to run OS commands, read Oracle user tables, browse and manage files, and unzip archives; operators used it to run whoami as SYSTEM and copy the Windows SAM, SECURITY and SYSTEM registry hives.
- Huntress warns this approach creates a blind spot for many endpoint tools and recommends input sanitization, removing CREATE JAVA SOURCE/exec privileges from app accounts, auditing DB objects, and adding database-aware detection.