Security researchers at Huntress have detailed an attack in which hackers abused a SQL injection vulnerability to plant a post-exploitation toolkit directly inside an Oracle database rather than dropping traditional executable files on the compromised server.

Huntress discovered the intrusion on July 27, 2026, after its platform flagged credential theft activity on a server hosting an Oracle database. Investigators traced the initial access to a vulnerable search endpoint in a public-facing Java application running on Apache Tomcat. The app’s autocomplete search feature failed to properly validate user input, letting attackers inject SQL commands. Huntress linked the malicious requests to the IP address 178.162.151[.]229.

Living inside the database

Instead of deploying malware to the file system, the attackers used Oracle’s embedded Java Virtual Machine and the CREATE JAVA SOURCE statement to compile and store a custom toolkit called khunt as a database schema object. Huntress described this technique as rarely documented in the wild.

The khunt toolkit consisted of several Java components and PL/SQL wrappers, including:

  • KhuntCmd, which launched cmd.exe to run operating system commands via SQL statements
  • KhuntHash, which pulled data from Oracle’s internal user table and wrote credentials to a file
  • KhuntFS and KhuntFS2, used for file browsing, searching, and size checks
  • KhuntT, a test function to confirm successful installation
  • KhuntUnzip, for extracting compressed archives

SYSTEM-level access confirmed

Using KhuntCmd, the attackers ran cmd.exe /c whoami and confirmed they had SYSTEM-level permissions on the underlying Windows server. They then used PowerShell and native Windows utilities to copy the SAM, SECURITY, and SYSTEM registry hives, files that can be used offline to recover local account password hashes. The attackers also ran tasklist /svc to enumerate running services, saving the results to a file named khunttasks.txt. Huntress said the registry hives were likely staged for exfiltration and credential dumping, though it could not confirm whether the files were actually stolen.

Mitigation guidance

Huntress recommends organizations sanitize all user-supplied input to prevent SQL injection and restrict the privileges granted to database accounts used by public-facing applications. Specifically, such accounts should not have permissions to create Java sources, execute unnecessary stored procedures, or perform other administrative database operations that could enable this kind of technique.