Attackers broke into a corporate network by exploiting a SQL injection flaw in a public-facing Java application and then hid a post-exploitation toolkit inside an Oracle database. Huntress said the vulnerable autocomplete search endpoint ran on Apache Tomcat and allowed arbitrary SQL commands against Oracle; the attackers stored Java code in Oracle using CREATE JAVA SOURCE, then used modules including KhuntCmd and KhuntHash to run SYSTEM-level Windows commands and copy the SAM, SECURITY, and SYSTEM registry hives for likely credential theft.
Why it matters: This matters because it shows a real-world attack path from a web app bug to full server-level credential theft, using database features many defenders may not monitor. Organizations running Oracle behind internet-facing applications should urgently review input validation, database privileges, Java-in-database capabilities, and signs of command execution or hive access on affected servers.
2026.08.25
94% relevant
This is the same Huntress-described intrusion and adds context from an Oracle support specialist that the attack did not depend on missing Oracle patches but on exposed SQL injection and risky Oracle database configuration, especially allowing in-database Java compilation.
info@thehackernews.com (The Hacker News)
2026.08.06
96% relevant
This is the same underlying incident and tradecraft: attackers exploited SQL injection in a Tomcat-hosted Java application, executed khunt from within Oracle Database, and used that foothold to gain Windows SYSTEM-level access. The article adds detail on the attacker compiling khunt inside Oracle as part of the escalation chain.
Lawrence Abrams
2026.08.05
100% relevant
This article establishes a distinct intrusion case centered on the khunt toolkit being embedded and executed from within an Oracle database after SQL injection through a Tomcat-hosted application.
← Back to all stories