Hackers Hide Khunt Toolkit Inside Oracle Database After SQL Injection Attack

Researchers have uncovered an Oracle database attack in which hackers used a SQL injection flaw to install a post-exploitation toolkit directly inside a database.

The incident shows how attackers can turn a vulnerable public-facing application into a path for deeper network access. Instead of dropping standard malware files on the server, the group stored Java code inside Oracle and used it to run commands with high-level Windows permissions.

Huntress detected the activity on July 27, 2026, after its platform identified credential theft attempts on a server running Oracle Database.

SQL injection opened the door

The attackers reportedly entered through a vulnerable search endpoint in an internet-facing Java application hosted on Apache Tomcat.

The application included an autocomplete search feature. However, it did not correctly validate submitted input. This allowed the attackers to inject SQL commands and interact with the underlying Oracle database.

Huntress traced the malicious requests to the IP address 178.162.151[.]229.

SQL injection flaws remain especially dangerous when applications connect to databases with excessive permissions. In this case, the database account appears to have had enough access to create and execute Java objects inside Oracle.

Khunt toolkit stored as Oracle Java objects

Oracle Database includes an embedded Java Virtual Machine. It also supports the CREATE JAVA SOURCE statement, which lets users store and compile Java source code as a database schema object.

Attackers abused this feature to deploy a toolkit called Khunt directly in the Oracle environment. The approach helped them avoid placing conventional executable files on the Windows server, potentially making the intrusion harder to spot.

Huntress said this technique has rarely been documented in real-world attacks.

The toolkit included several Java components and PL/SQL wrappers designed for post-exploitation activity. These tools gave the attackers ways to run operating system commands, inspect files, collect credentials, and unpack compressed archives.

Toolkit enabled command execution and credential theft

One component, called KhuntCmd, launched cmd.exe and allowed attackers to run Windows commands through SQL statements.

The attackers used it to run cmd.exe /c whoami. The command confirmed that activity launched through the Oracle database ran with SYSTEM-level permissions on the Windows server.

Other Khunt components included:

• KhuntHash, which accessed Oracle’s internal user table and wrote usernames and password data to a file.
• KhuntFS and KhuntFS2, which supported file browsing, reading, searching, and file-size checks.
• KhuntT, which acted as a simple test to confirm that the toolkit worked.
• KhuntUnzip, which extracted compressed files.

After gaining command execution, the attackers used PowerShell and built-in Windows tools to copy the SAM, SECURITY, and SYSTEM registry hives. These files can help attackers recover password hashes for local Windows accounts.

They also used tasklist /svc to identify running services and saved the results to a file named khunttasks.txt.

Huntress said the registry hives were likely collected for credential dumping. However, the report did not confirm whether the attackers successfully exfiltrated them.

Oracle database attack highlights privilege risks

The incident underlines why public-facing applications should use database accounts with only the permissions they need.

Organisations should validate and sanitise all user-supplied input to reduce SQL injection risks. They should also prevent application database accounts from creating Java sources, executing unnecessary stored procedures, or carrying out administrative actions.

Restricting database privileges can limit the damage even when an attacker finds a way to exploit a vulnerable application.