Executive Overview
In the rapidly evolving landscape of enterprise cybersecurity, threat actors continually seek innovative methods to bypass traditional perimeter defenses and Endpoint Detection and Response (EDR) agents. A chilling reminder of this ingenuity surfaced in late July 2026, when cybersecurity researchers at Huntress uncovered a sophisticated, stealthy cyberattack targeting an organization’s mission-critical Oracle database.
Rather than deploying conventional malware binaries, web shells, or executable files to the host operating system’s filesystem, the attackers executed a completely fileless, living-off-the-land post-exploitation campaign. By exploiting a vulnerability in a public-facing web application, the threat actors injected unvalidated input that traversed a Java Database Connectivity (JDBC) connection, ultimately manipulating Oracle’s embedded Java Virtual Machine (JVM).
By feeding raw Java source code directly into the database engine, the malicious actors forced Oracle to compile the code into internal stored schema objects. This allowed them to execute arbitrary commands, escalate privileges, and pillage sensitive system registries on the underlying Windows server—all while operating entirely within the memory space and internal data structures of the database.
Tracked by Huntress researchers under the identifier "khunt," this sophisticated toolkit underscores a terrifying reality for enterprise database administrators: the database is no longer merely a passive repository for queries; it has been successfully transformed into an active beachhead for lateral movement, privilege escalation, and persistent internal control. Because standard EDR tools are blind to the internal compiled state of database engines, organizations running enterprise-grade relational database management systems (RDBMS) face a staggering monitoring blind spot.
Detailed Chronology: The Anatomy of a Stealth Breach
The incident, which came to light on July 27, 2026, began not with a direct assault on the core database infrastructure, but at the vulnerable perimeter of a public-facing corporate web application.
Phase 1: The Initial Foothold via SQL Injection
The attack lifecycle commenced when threat actors identified a classic SQL injection vector residing within an unassuming autocomplete search field on a public-facing web portal. When users interacted with the search feature, the application dynamically processed inputs and passed them directly to the backend database over a JDBC connection.
Critically, the database account tied to this JDBC connection possessed excessively broad privileges—permissions that extended far beyond simple SELECT, INSERT, or UPDATE commands. Specifically, the account held the authorization necessary to compile and create Java source objects within the database schema. Recognizing this fatal configuration flaw, the attackers injected malicious payloads designed to leverage Oracle’s native extensibility features.
Phase 2: In-Memory Compilation and Tooling Deployment
Rather than dropping a malicious .exe, .dll, or script file onto the Windows host filesystem—actions that would have immediately tripped modern EDR heuristics—the adversaries utilized Oracle’s CREATE JAVA SOURCE statement.
They fed custom Java source code directly into the database. The embedded JVM seamlessly compiled the raw text into stored schema objects. By wrapping these Java classes in PL/SQL wrappers, the attackers built a fully functional post-exploitation toolkit dubbed Khunt without leaving a single traditional file artifact on the host hard drive.
Huntress later identified that the toolkit comprised six primary Java objects alongside several khunt_* PL/SQL wrapper functions. These components collectively formed a command-and-control bridge, granting the actors deep operational capabilities inside the host environment.
Phase 3: Privilege Escalation and System Reconnaissance
Once the Khunt toolkit was established within the database schema, the attackers began probing the boundaries of the underlying operating system. Leveraging the Java execution mechanisms—specifically utilizing Runtime.exec capabilities exposed through the compiled classes—the adversaries executed system-level diagnostic and discovery commands.
When they invoked the custom database function KhuntCmd to run cmd.exe /c whoami, the command returned SYSTEM, indicating that the database service was running with the highest possible level of Windows operating system privileges.
With SYSTEM-level access secured, the threat actors wasted no time conducting broad local reconnaissance and credential harvesting:
- Registry Hive Extraction: The attackers utilized native administrative utilities like PowerShell and
reg.exeto copy critical operating system registry hives, specifically targeting theSECURITYandSYSTEMhives, staging them locally withinF:Oracle. - Process Enumeration: To map running services and administrative dependencies, they executed
tasklist /svcand output the results into a file namedkhunttasks.txt. - SAM Database Harvesting: Utilizing
esentutl.exe, a legitimate Windows database utility, the attackers duplicated the Security Account Manager (SAM) and additionalSECURITYhives to facilitate offline password cracking.
Although Huntress investigators observed these sensitive files being staged locally on the server during the incident response phase, definitive evidence confirming their successful exfiltration across the command-and-control channel (traced back to IP address 178.162.151[.]229) remains inconclusive. Nevertheless, the compromise of the SAM and SYSTEM hives grants attackers the keys to the kingdom, effectively guaranteeing domain-wide persistence if left remediated.
Supporting Context & Metrics: A Two-Decade-Old Technique Revived
While the specific "Khunt" naming convention and tooling artifacts observed in July 2026 are modern, the foundational technique exploited by the attackers is far from new. In the cybersecurity community, leveraging database engines for operating system command execution is a well-documented—albeit infrequently observed in the wild—attack vector.
Historical Context: The Evolution of ORAEXEC
The lineage of this attack methodology dates back at least two decades. In 2006, prominent security researcher Marco Ivaldi published a classic proof-of-concept script known as raptor_oraexec.sql. This script demonstrated how an attacker with appropriate privileges could create Oracle source objects containing embedded command-execution and file-read methods, subsequently publishing them to SQL through PL/SQL wrappers.
The Khunt toolkit relies on the exact same foundational architecture. Despite software vendors implementing various hardening guidelines over the past twenty years, the core systemic risk remains: relational databases are complex, extensible computational platforms capable of executing external code when administrative guards fail.
Oracle Architecture and Privilege Requirements
To fully comprehend how the Khunt attack succeeded, one must examine Oracle’s architectural relationship with Java:
- Embedded JVM: Oracle databases ship with a robust, integrated Java Virtual Machine. This environment allows developers to write business logic in Java and run it directly inside the database server process.
- Privilege Thresholds: According to official Oracle documentation, creating a Java source object within a user’s own schema technically requires a relatively modest baseline system privilege:
CREATE PROCEDURE. - OS-Level Spawning: Spawning an operating-system process from within compiled Java code requires invoking
Runtime.exec. Oracle documentation explicitly states that permissions to execute external runtime processes should be strictly tightly controlled, issued exclusively to trusted, highly privileged database administrators via fine-grained Java security policies.
In the case investigated by Huntress, the exact granularity of the grants held by the compromised JDBC account was not publicly detailed. However, because the attack chain executed flawlessly from end to end, the account possessed—or successfully bypassed—all necessary authorization barriers to compile code, invoke runtime execution, and inherit SYSTEM-level privileges on the Windows host.
Threat Intelligence & Technical Indicators
Defending against fileless database attacks requires a paradigm shift in how security operations centers (SOCs) monitor internal RDBMS telemetry. Traditional endpoint tools focus heavily on file creation, suspicious process ancestry, and anomalous binary execution. None of these indicators trigger when an attack is compiled and executed within memory schemas.
Key Artifacts and Indicators of Compromise (IoCs)
Organizations utilizing Oracle databases should immediately review their database logs, schema objects, and audit trails for the following specific indicators associated with the Khunt campaign:
- Schema Object Nomenclature: Search the Oracle installation catalog for database object names and classes beginning with the prefix
Khuntorkhunt_. - SQL Audit Logs: Inspect enterprise SQL execution logs and query history for statement strings matching the wildcard pattern
KHUNT%. - External IP Address: Network traffic analysis should be cross-referenced against communications involving the threat actor infrastructure node:
178.162.151[.]229. - Staged Filesystem Artifacts: Review local staging directories (such as
F:Oraclein this specific incident) for unauthorized text dumps (khunttasks.txt), registry hive copies, or unexpected usage of native utilities likeesentutl.exe.
The Absence of Patch-Based Remediation
Crucially, no single Oracle software patch exists that can automatically close this security gap, because the attack relies on the legitimate misuse of built-in database design features rather than a memory corruption bug or software vulnerability.
Because CREATE JAVA SOURCE and JDBC integrations are foundational features required by countless legitimate enterprise applications, vendors cannot simply disable them out-of-the-box without breaking enterprise workflows. Consequently, defense relies entirely on rigorous configuration hardening, stringent input validation, and aggressive internal threat hunting.
Strategic Mitigation and Remediation Recommendations
Mitigating the threat of database-resident fileless toolkits requires a multi-layered defense strategy combining secure coding practices, rigorous identity and access management (IAM), and specialized database activity monitoring (DAM).
1. Application-Layer Defenses: Eradicating SQL Injection
The initial entry point for the Khunt attack was a classic SQL injection vulnerability within an autocomplete web form. Securing the database begins at the application perimeter:
- Parameterized Queries: Ensure all database queries utilize parameterized statements or prepared statements to strictly separate executable code from user-supplied data inputs.
- Rigorous Input Validation: Implement comprehensive whitelist-based input validation on all web application parameters, search fields, and API endpoints before data ever traverses the JDBC connection layer.
2. Database-Layer Hardening: Enforcing the Principle of Least Privilege
The severity of the compromise was exponentially magnified by the over-privileged nature of the database account tied to the web application. Administrators must audit database grants immediately:
- Revoke Unnecessary Privileges: Accounts servicing public-facing web applications should operate under strict least-privilege principles. Under no circumstances should a web-facing service account hold
CREATE PROCEDURE,CREATE JAVA SOURCE, or elevated execution grants unless explicitly required and micro-segmented. - Lock Down Java Security Policies: Restrict the execution scope of
java.lang.Runtimeandjava.io.Filepermissions within the Oracle JVM. Ensure that security policies explicitly deny untrusted schemas from invoking operating system processes.
3. Proactive Database Hunting and Monitoring
Because standard EDR agents cannot inspect the internal memory structures or schema objects of an Oracle database engine, security teams must deploy specialized Database Activity Monitoring (DAM) and automated hunting scripts:
- Regular Schema Audits: Periodically query the data dictionary (
USER_OBJECTS,ALL_OBJECTS, andDBA_OBJECTS) to inspect newly compiled Java classes, triggers, and procedures, paying special attention to unexpected naming conventions. - Log Aggregation: Centralize database audit logs into a Security Information and Event Management (SIEM) platform, creating custom correlation rules to alert on anomalous administrative command execution originating from database background processes.
Future Outlook: The Next Frontier of Database Threats
As perimeter defenses, endpoint detection agents, and cloud security postures become increasingly mature, sophisticated threat actors are naturally migrating toward less-monitored computational environments. Enterprise databases—often treated as walled gardens protected by firewalls and network segmentation—represent an increasingly attractive frontier for advanced persistent threat (APT) groups and financially motivated cybercriminal syndicates alike.
The emergence of the Khunt toolkit serves as a wake-up call for the cybersecurity industry. We are likely to witness an increase in "living-off-the-database" techniques across various relational and NoSQL database platforms (including Microsoft SQL Server, PostgreSQL, and MySQL), where attackers leverage built-in stored procedures, user-defined functions (UDFs), and embedded scripting engines to maintain persistence and execute lateral movement.
To counter this evolving threat vector, organizations must bridge the traditional gap between application security, database administration, and security operations. Database administrators and cybersecurity teams can no longer operate in silos. Only through continuous internal threat hunting, strict adherence to the principle of least privilege, and deep visibility into database internals can modern enterprises hope to keep the ghost out of the database.
If you found this investigative report insightful, stay ahead of emerging cyber threats by following The Hacker News on Google News, Twitter (@thehackersnews), and LinkedIn for exclusive, authoritative reporting.
