Huntress discovered attackers exploiting a SQL injection flaw in an Apache Tomcat application to embed a post-exploitation toolkit called khunt directly inside an Oracle database, achieving SYSTEM-level command execution on the underlying Windows server.
Attackers exploited a SQL injection vulnerability in a public-facing Java application to install a post-exploitation toolkit directly inside an Oracle database, using the database's own embedded Java runtime to execute commands with SYSTEM-level privileges on the underlying Windows server, according to research published by Huntress.
The attack, first reported by BleepingComputer, was discovered by Huntress on July 27, 2026, after its security platform detected credential theft on a server hosting an Oracle database instance.
Apache access logs revealed that attackers entered through a vulnerable search endpoint in an application running on Apache Tomcat. The application failed to properly validate input submitted through an autocomplete search feature, allowing attackers to issue arbitrary SQL commands directly to the database. Huntress traced the malicious requests to the IP address 178.162.151[.]229.
After exploiting the injection flaw, the attackers installed a toolkit called khunt as a Java object stored within the Oracle database schema. Oracle's embedded Java Virtual Machine, combined with the CREATE JAVA SOURCE statement, allows Java source code to be compiled and stored inside the database — and, if configured with sufficient privileges, executed against the host operating system.
"The use of the technique in the wild has rarely been documented," Huntress said.
The khunt toolkit consisted of multiple Java components and PL/SQL wrappers. KhuntCmd launched cmd.exe and allowed operating system commands to be run through SQL statements. KhuntHash accessed Oracle's internal user table and wrote usernames and password data to a file. KhuntFS and KhuntFS2 provided file browsing, reading, searching, and file-size checking capabilities. KhuntT acted as a connectivity test to confirm successful installation, and KhuntUnzip extracted compressed archives.
Using KhuntCmd to run cmd.exe /c whoami, the attackers confirmed that commands executed through the database carried SYSTEM-level permissions on the Windows server — the highest privilege level available.
They subsequently used PowerShell and native Windows utilities to copy the SAM, SECURITY, and SYSTEM registry hives, which contain password hashes for local Windows accounts. The attackers also ran tasklist /svc to enumerate running services, saving the output to a file named khunttasks.txt.
Huntress assessed the registry hives were likely exfiltrated for offline credential dumping, though the report does not confirm whether the files were successfully stolen.
The incident highlights the risk of granting excessive database privileges to application accounts. Huntress recommends that accounts used by public-facing applications should not hold privileges sufficient to create Java sources, execute unnecessary stored procedures, or carry out other administrative database actions. As a baseline, Huntress said organizations should sanitize all user-supplied input and limit the scope of permissions granted to application database accounts.
The technique of embedding malicious code inside a database's native runtime — rather than deploying executable files to the server's file system — allows attackers to sidestep endpoint defenses that monitor for suspicious binaries, reinforcing the case for coverage at the database layer as well as the operating system layer. Security teams that rely solely on endpoint detection may not observe this class of activity until significant access has already been established.
Sara Montes de Oca is the Editor in Chief of TechEchelon. Previously a correspondent and producer in Washington, D.C., covering business, finance, and politics.
More from Sara →A cyberattack on Apple supplier Tata Electronics has given Beijing a propaganda opening to cast doubt on India's manufacturing reliability, even as technicians in China's Huaqiangbei market admit they cannot replicate the iPhone 18 Pro from the leaked data.
Apple has filed a new legal challenge against a U.K. government demand to access encrypted data held by British customers, escalating a dispute that previously drew intervention from senior U.S. officials including President Trump and Vice President Vance.
The ExfilSquad data extortion group has claimed responsibility for a breach of the U.K.'s Police National Legal Database, alleging it stole 135,000 contact records belonging to police officers, staff, and criminal justice professionals.
Written for readers who already know the basics — markets, AI, and the policy decisions that shape both.