Full Report
Attackers broke into an organization's Oracle database through a SQL injection flaw in a public-facing web application, then installed a post-exploitation toolkit without writing an executable to disk. They fed Java source code to the database, let Oracle compile it into stored schema objects, and ran commands from inside the database engine. Huntress, which tracks the toolkit as khunt,
Analysis Summary
# Incident Report: Use of "khunt" Toolkit in Oracle Database Exploitation
## Executive Summary
Attackers exploited a SQL injection vulnerability in a public-facing web application to deploy a post-exploitation toolkit called "khunt" directly into an Oracle database. By leveraging Oracle's embedded Java Virtual Machine (JVM), the threat actors compiled Java source code into database schema objects, achieving SYSTEM-level privileges on the underlying Windows host. The attack is notable for its fileless nature, as the malicious code resided within the database rather than as executables on the filesystem.
## Incident Details
- **Discovery Date:** July 27, 2026
- **Incident Date:** July 2026
- **Affected Organization:** Not disclosed
- **Sector:** Not disclosed
- **Geography:** Not disclosed
## Timeline of Events
### Initial Access
- **Date/Time:** July 2026
- **Vector:** SQL Injection (SQLi)
- **Details:** Attackers exploited an unvalidated autocomplete search field in a web application. The application connected to the Oracle database via JDBC using an over-privileged account.
### Lateral Movement
- **Details:** After gaining a foothold via SQLi, the attackers used the `CREATE JAVA SOURCE` statement to inject Java code. This code was compiled by the Oracle JVM into schema objects, allowing the attackers to execute OS-level commands (via `Runtime.exec`) and interact with the Windows filesystem as the SYSTEM user.
### Data Exfiltration/Impact
- **Details:** Attackers targeted credential stores. They used `reg.exe` and `esentutl.exe` to copy the Windows SAM, SECURITY, and SYSTEM registry hives to a staging folder (`F:\Oracle`). They also generated a list of running services (`khunttasks.txt`). While staging was observed, exfiltration was not explicitly confirmed in the report.
### Detection & Response
- **How it was discovered:** Huntress detected credential-theft activity on July 27, 2026.
- **Response actions taken:** Investigation by Huntress identified the "khunt" toolkit within the Oracle database; forensic analysis traced the activity back to the SQL injection flaw.
## Attack Methodology
- **Initial Access:** SQL Injection via a web application autocomplete field.
- **Persistence:** Creation of stored Java schema objects and PL/SQL wrappers within the Oracle database.
- **Privilege Escalation:** Exploitation of over-privileged database service accounts to execute code as Windows **SYSTEM**.
- **Defense Evasion:** "Fileless" execution; malicious code stored inside database objects rather than as binaries on disk, bypassing traditional EDR inspection.
- **Credential Access:** Reading Oracle password hashes via `KhuntHash`; dumping Windows registry hives (SAM/SYSTEM).
- **Discovery:** Execution of `tasklist /svc` to map running services.
- **Lateral Movement:** Execution of arbitrary OS commands via `KhuntCmd`.
- **Collection:** Staging registry hives and database user hashes in local directories.
- **Exfiltration:** Potential exfiltration of staged credential files (not confirmed).
- **Impact:** Full compromise of the database server and underlying host.
## Impact Assessment
- **Financial:** Undetermined; includes costs of incident response and remediation.
- **Data Breach:** Compromise of Oracle database password hashes and Windows system credentials.
- **Operational:** High; attackers achieved SYSTEM-level access on the database server.
- **Reputational:** Potential impact depending on the sensitivity of the data stored in the compromised database.
## Indicators of Compromise
- **Network indicators:** `178.162.151[.]229`
- **File indicators:** `F:\Oracle\khunttasks.txt`, staged registry hive copies (SAM, SECURITY, SYSTEM).
- **Behavioral indicators:**
- Database objects named with the prefix `Khunt` or `khunt_`.
- `CREATE JAVA SOURCE` commands appearing in SQL logs.
- Presence of Java classes: `KhuntCmd`, `KhuntHash`, `KhuntFS`, `KhuntFS2`, `KhuntT`, `KhuntUnzip`.
## Response Actions
- **Containment:** Blocking of the identified malicious IP address.
- **Eradication:** Removal of malicious Java schema objects and PL/SQL wrappers from the Oracle database.
- **Recovery:** Restoration of secure application code and rotation of all compromised credentials (DB and Windows).
## Lessons Learned
- **Architecture Flaw:** EDR tools often lack visibility into internal database operations (like Java compilation), creating a blind spot for fileless persistence.
- **Legacy Techniques:** The attack utilizes a 20-year-old technique (Oracle JVM exploitation) that remains effective against modern, over-privileged environments.
- **Visibility:** Monitoring SQL logs for DDL (Data Definition Language) statements like `CREATE JAVA` is critical for detecting database-native attacks.
## Recommendations
- **Input Validation:** Implement parameterized queries (prepared statements) to eliminate SQL injection vulnerabilities.
- **Principle of Least Privilege:** Ensure database accounts used by web applications do not have `CREATE PROCEDURE` or `CREATE JAVA SOURCE` privileges.
- **JVM Hardening:** Disable or restrict the Oracle JVM if not required for business logic; specifically restrict `Runtime.exec` permissions.
- **Database Auditing:** Enable fine-grained auditing on sensitive tables and the creation of schema objects.