Cybersecurity researchers have uncovered a sophisticated cyberattack in which threat actors exploited a SQL Injection vulnerability in an Oracle database to install a post-exploitation toolkit directly inside the database. The technique enabled the attackers to execute operating system commands, access sensitive data, and steal credentials without deploying traditional malware files on the compromised server.
According to cybersecurity firm Huntress, the attack was detected on July 27, 2026, after its security platform identified suspicious credential theft activity on a server hosting an Oracle database. The investigation revealed that the attackers gained initial access by exploiting a SQL Injection vulnerability in the search endpoint of a publicly accessible Java-based web application.
The report states that the application, running on Apache Tomcat, failed to properly validate user input submitted through its autocomplete search feature. By exploiting this weakness, the attackers executed arbitrary SQL commands against the Oracle database and established further access. Investigators also traced the malicious activity to a specific IP address.
The attackers then abused Oracle’s embedded Java Virtual Machine (JVM) and the CREATE JAVA SOURCE functionality to install a post-exploitation toolkit known as “khunt” directly into the database as Java objects. This Oracle feature allows Java source code to be stored as database schema objects and executed through SQL commands. When sufficient privileges are available, these Java objects can also execute commands on the underlying operating system.
Researchers noted that this technique has rarely been observed in real-world cyberattacks, making the incident particularly significant. By storing the toolkit entirely within the database instead of placing executable files on the server, the attackers were able to reduce their visibility and make detection by conventional security tools considerably more difficult.
The toolkit consisted of multiple Java components and PL/SQL wrappers designed for different post-compromise activities. KhuntCmd enabled operating system command execution, KhuntHash extracted usernames and password-related information from Oracle’s internal user tables, KhuntFS and KhuntFS2 provided file browsing, searching, and reading capabilities, KhuntT verified successful installation of the toolkit, and KhuntUnzip was used to extract compressed files.
During the investigation, Huntress found that the attackers executed cmd.exe /c whoami through KhuntCmd, confirming that commands issued from the Oracle database were running with SYSTEM-level privileges on the Windows server. The attackers subsequently used PowerShell and native Windows utilities to copy the SAM, SECURITY, and SYSTEM registry hives, which can be used to recover password hashes for local Windows accounts. They also executed tasklist /svc to enumerate running services and stored the output in a text file for further analysis.
The report indicated that the registry hives were likely prepared for credential dumping and possible exfiltration. However, researchers said there was no confirmed evidence that the files were successfully stolen from the compromised environment.
A Researcher at Algoritha Security said the incident demonstrates that legacy vulnerabilities such as SQL Injection continue to pose serious cybersecurity risks when secure coding practices are not followed. The researcher stressed that organizations should implement strict input validation, enforce the principle of least privilege, and ensure that database accounts are granted only the permissions required for their intended functions.
Cybersecurity experts further advised organizations to prevent database accounts associated with public-facing applications from creating Java source objects, executing unnecessary stored procedures, or performing administrative operations. They also recommended regular security assessments, robust SQL Injection protections, continuous database activity monitoring, and timely patch management to reduce the risk of similar advanced attacks.
