427/69 Friday, August 7, 2026
Cybersecurity researchers from Huntress reported detecting a cyberattack in late July 2026, in which hackers exploited a SQL Injection vulnerability to deploy a post-exploitation toolkit called khunt directly inside an organization’s Oracle database. The attack was carried out through a public-facing Java application running on Apache Tomcat. In this incident, the attackers chose to hide the malicious toolkit in the database rather than placing executable files on the server as usual, making detection more difficult and potentially causing serious damage to the organization’s network.
The attack began because the application lacked proper input validation in an autocomplete search feature, allowing the attackers to send malicious SQL commands to invoke Java Virtual Machine functions embedded in Oracle and create Java objects to run the khunt toolkit. The toolkit includes a wide range of capabilities, such as executing operating system commands with SYSTEM-level privileges on a Windows server, extracting usernames and passwords from the database, and accessing the file system. In addition, the attackers attempted to copy sensitive data from the Windows Registry, including SAM, SECURITY, and SYSTEM, which could be used to crack system passwords. However, it has not yet been officially confirmed whether the attackers successfully exfiltrated this data.
To prevent and reduce the risk of this type of threat, organizational administrators should strictly review and improve input sanitization for user-supplied data. In addition, the principle of least privilege should be enforced for database accounts connected to public-facing applications. These accounts should not be granted excessive permissions, such as the ability to create Java Source objects, execute unnecessary stored procedures, or use other high-level administrative privileges. Regular review of access logs can also help detect anomalies and enable timely response to security incidents.