Overview
- Huntress began investigating credential-theft alerts on July 27, 2026, and traced the intrusion to a vulnerable autocomplete search endpoint on a public Java web app that allowed SQL injection into an Oracle backend.
- Attackers used Oracle's CREATE JAVA SOURCE feature to upload and compile a multi-component toolkit called khunt as Java schema objects with PL/SQL wrappers, keeping the code inside the database rather than as files on disk.
- One khunt module (KhuntCmd) ran cmd.exe /c whoami and returned SYSTEM, after which the intruders used PowerShell and Windows utilities to copy SAM, SECURITY and SYSTEM registry hives and enumerate services into F:\Oracle.
- Huntress and reporting outlets note that storing malicious Java classes and PL/SQL objects inside Oracle creates a blind spot for traditional EDR and antivirus tools that do not inspect database internals.
- Investigators urge immediate hunting for khunt indicators in Oracle (object names beginning Khunt, SQL logs with KHUNT%), fast patching of application input validation, and strict least-privilege for app database accounts to prevent similar attacks.