Hackers recently abused a SQL injection flaw in a public-facing Java application to plant a post-exploitation toolkit called khunt directly inside an Oracle database, showing how database abuse can become a full network compromise. The case was discovered by Huntress on July 27, 2026, after its security platform detected credential theft on a server hosting an Oracle database.
The intrusion began through a vulnerable autocomplete search feature on an Apache Tomcat application that did not properly validate input, allowing attackers to issue SQL commands against the database. Huntress traced the malicious traffic to the IP address 178.162.151[.]229. What makes this incident unusual is that the attackers did not drop a normal executable on the server. Instead, they used Oracle’s Java support, including the CREATE JAVA SOURCE capability, to store and compile the khunt toolkit as a database object, something Huntress said is rarely documented in the wild.
The toolkit included several modules with distinct roles: KhuntCmd for running Windows commands, KhuntHash for extracting usernames and password data, KhuntFS and KhuntFS2 for file browsing and searching, KhuntT for testing whether installation succeeded, and KhuntUnzip for unpacking compressed files. The attackers even used KhuntCmd to run whoami, confirming SYSTEM-level execution on the Windows host.
From there, they used PowerShell and Windows tools to copy the SAM, SECURITY, and SYSTEM registry hives, which could be used for credential dumping, and they ran tasklist /svc to enumerate services. Huntress advised organizations to sanitize user input, restrict privileges on application database accounts, and avoid giving public-facing databases the power to create Java sources or run administrative actions.