Overview
- Huntress first detected credential‑theft activity on a Windows host on July 27, 2026 and traced the chain to a public‑facing Java autocomplete endpoint that accepted unvalidated input over JDBC.
- Attackers exploited the SQL injection to run Oracle's CREATE JAVA SOURCE and compile a multi‑module post‑exploitation toolkit called khunt as schema objects inside the database.
- Khunt included Java components and PL/SQL wrappers that launched cmd.exe, read Oracle user tables, browsed the file system, unzipped archives, and confirmed reachability.
- Using khunt the intruders executed commands that returned SYSTEM on the Windows host and staged the SAM, SECURITY and SYSTEM registry hives, though Huntress did not confirm successful exfiltration.
- Investigators warn this technique creates a blind spot for endpoint tools that do not inspect database‑resident Java classes and urge immediate fixes: parameterize queries, validate inputs, and remove CREATE JAVA SOURCE and similar privileges from public‑facing accounts.