Particle.news

SQL Injection Used to Install ‘khunt’ Toolkit Inside Oracle Database, Giving Attackers Windows SYSTEM Access

Security firm Huntress says the attack shows how compiling Java inside an Oracle database can bypass endpoint defenses and let attackers run OS commands from the database.

Overview

  • Huntress began investigating credential-theft alerts on July 27, 2026, and traced the intrusion to a vulnerable autocomplete search endpoint on a public Java web app that allowed SQL injection into an Oracle backend.
  • Attackers used Oracle's CREATE JAVA SOURCE feature to upload and compile a multi-component toolkit called khunt as Java schema objects with PL/SQL wrappers, keeping the code inside the database rather than as files on disk.
  • One khunt module (KhuntCmd) ran cmd.exe /c whoami and returned SYSTEM, after which the intruders used PowerShell and Windows utilities to copy SAM, SECURITY and SYSTEM registry hives and enumerate services into F:\Oracle.
  • Huntress and reporting outlets note that storing malicious Java classes and PL/SQL objects inside Oracle creates a blind spot for traditional EDR and antivirus tools that do not inspect database internals.
  • Investigators urge immediate hunting for khunt indicators in Oracle (object names beginning Khunt, SQL logs with KHUNT%), fast patching of application input validation, and strict least-privilege for app database accounts to prevent similar attacks.