SQL Injection Attack Leads to Malware Hosting in Oracle Database

On July 27, 2026, Huntress identified a SQL injection attack that allowed threat actors to install a post-exploitation toolkit named Khunt directly within an Oracle database. The attackers exploited a vulnerability in a public-facing Java application that failed to validate user input, enabling them to execute SQL commands. They utilized Oracle's embedded Java Virtual Machine to upload and compile malicious Java code, which facilitated SYSTEM-level command execution on the compromised Windows server. The attack resulted in the theft of sensitive credentials by dumping registry hives (SAM, SECURITY, SYSTEM). Huntress traced the attack to the IP address 178.162.151[.]229. The use of this technique, while rarely documented, demonstrates a sophisticated approach to maintaining persistence and evading detection. Organizations are advised to implement strict input validation and limit database account privileges to mitigate similar attacks.

Key Points: • Attackers exploited a SQL injection vulnerability in a public-facing Java application. • Malware named Khunt was installed directly in the Oracle database using Java capabilities. • The attack led to credential theft through the dumping of Windows registry hives.