Affected Systems

Oracle databases with Java Virtual Machine enabled, particularly those connected to public-facing Java applications (Apache Tomcat observed). Specific Oracle versions not disclosed. Attack vector: SQL injection via unsanitized input in web application autocomplete feature.

Exploitation Status

Active exploitation confirmed. Huntress detected live attack on July 27, 2026. Attackers used SQL injection to deploy khunt post-exploitation toolkit as Java objects stored within Oracle database schema. Attack originated from IP 178.162.151[.]229. Technique rarely documented in the wild.

Business Impact

Attackers achieved SYSTEM-level code execution on Windows host via Oracle's embedded JVM and CREATE JAVA SOURCE functionality. Credential theft confirmed: SAM, SECURITY, and SYSTEM registry hives copied for offline hash extraction. Toolkit enabled persistent command execution, file system access, and credential dumping without deploying traditional malware files. Detection evasion high due to toolkit residing entirely within database schema objects. Organizations with Oracle databases exposed via vulnerable web applications face immediate risk of full network compromise.

Urgency

🔴 Immediate

Recommended Actions

  • Audit all Oracle database accounts used by public-facing applications; revoke CREATE JAVA SOURCE, CREATE PROCEDURE, and other administrative privileges not required for application function
  • Review Oracle database schema objects for unauthorized Java sources using: SELECT * FROM USER_JAVA_SOURCES and ALL_JAVA_SOURCES; investigate any objects named khunt* or recently created Java objects
  • Implement strict input validation and parameterized queries in all web applications interfacing with Oracle databases, especially autocomplete and search features
  • Block outbound connections from IP 178.162.151[.]229 and monitor Apache Tomcat access logs for SQL injection patterns targeting search endpoints
  • Enable Oracle database auditing for CREATE JAVA SOURCE statements and execution of Java stored procedures; forward audit logs to SIEM for anomaly detection