The incident, detected on July 27, 2026, shows how insecure public-facing applications can allow attackers to move from a database query to full control of the underlying operating system.
The initial alert involved credential theft activity on a Windows endpoint hosting an Oracle database. Security tools detected reg.exe creating copies of sensitive registry hives, including SAM, SECURITY, and SYSTEM.
These files can allow attackers to extract password hashes and gain access to local accounts.
Investigators found that the suspicious reg.exe process had been launched by oracle.exe. This unusual parent-child process relationship led Huntress to examine how the attackers gained access to the Oracle environment.
Apache Tomcat access logs revealed the initial entry point: SQL injection against a public-facing Java application connected to Oracle through JDBC.
The vulnerable application accepted SQL commands submitted through an input field without validating or safely parameterizing the data.
SQL injection is not a new vulnerability class. It usually occurs when an application directly passes user-controlled input into a database query.
For example, a username search field should reject SQL syntax and use parameterized queries. Without these safeguards, an attacker can insert database commands instead of normal text.
Oracle SQLi Achieves SYSTEM
After gaining SQL injection access, the threat actor uploaded a database-resident post-exploitation toolkit called khunt.
The toolkit used Oracle’s embedded Java Virtual Machine, which enables Java source code to be stored and compiled as database objects through the CREATE JAVA SOURCE statement.
The attackers sent malicious CREATE JAVA SOURCE commands from the Tomcat application to Oracle through its JDBC connection. Oracle then compiled the supplied Java code inside the database and stored it as schema objects.
This approach allowed the attackers to keep their tooling within the Oracle database rather than placing conventional malware files directly on disk.
The technique resembles prior research into Oracle SQL injection-to-RCE methods, including tools commonly described as oraexec.
However, Huntress noted that documented real-world use of this database-resident technique remains rare.
This method is especially concerning because traditional endpoint security products mainly inspect files, binaries, memory, and processes.
Malicious Java classes and PL/SQL wrappers hidden inside an Oracle database may receive less scrutiny, huntress said.
Indicators of Compromise
| IOC / Artifact | Type | Description |
|---|---|---|
178.162.151[.]229 | IP address | Suspected attacker infrastructure observed sending requests to the vulnerable application endpoint |
[drive:]\Oracle\khuntSECURITY.hiv | File | Dumped Windows SECURITY registry hive |
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN. Gain complete phishing visibility to strengthen your SOC and reduce MTTR
