Threat reportThreat IntelligenceTL-2026-1910
Attackers Compile khunt Toolkit Inside Oracle Database to Escalate SQL Injection to Windows SYSTEM Access
Attackers Compile khunt Toolkit Inside Oracle Database to (TL-2026-1910) is a critical-severity tracked intrusion set, first published 2026-08-06. It has no confirmed attribution, affects Apache Tomcat, maps to 11 MITRE ATT&CK techniques (T1003, T1007, T1033), and is covered by 9 detection rules and 13 indicators of compromise.
- Severity
- CRITICALAssessed severity
- CVEs
- 0None referenced
- Techniques
- 11MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 13Indicators of compromise
Key facts for TL-2026-1910
- Threat ID
- TL-2026-1910
- Severity
- CRITICAL
- Status
- ACTIVE
- Category
- THREAT_INTEL
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, enterprise
- Target regions
- North America, Europe
- Detection rules
- 9
- Indicators of compromise
- 13
Malware and tooling in Attackers Compile khunt Toolkit Inside Oracle Database to
Malware and tooling: khunt, KhuntCmd, KhuntFS, KhuntFS2, KhuntHash, KhuntT, KhuntUnzip, Reg - S0075, Tasklist - S0057, cmd - S0106, esentutl - S0404
How Attackers Compile khunt Toolkit Inside Oracle Database to works
Huntress DFIR investigation (July 2026) revealed an intrusion where attackers exploited a SQL injection vulnerability in a public-facing Java/Tomcat application to gain initial access to an Oracle database, then used the database's embedded JVM via CREATE JAVA SOURCE to compile the khunt post-exploitation toolkit as fileless Java schema objects, achieving SYSTEM-level code execution on the underlying Windows Server and dumping SAM/SECURITY registry hives for credential theft.
In July 2026, Huntress detected credential-theft alerts on a server hosting an Oracle database, triggering a DFIR investigation that uncovered a multi-stage intrusion chain. The attack began with a SQL injection vulnerability in a public-facing Java/Tomcat web application — specifically an autocomplete search field that passed unvalidated user input to the Oracle database via a JDBC connection without prepared statements or input sanitization. The database account serving the application held excessive privileges, including the ability to create Java source and procedure schema objects.
The attacker exploited Oracle's embedded Java Virtual Machine (JVM) using the CREATE JAVA SOURCE statement — a legitimate Oracle feature that compiles and stores Java source code as a persistent database schema object, entirely fileless on the operating system. This technique was first publicly documented by Marco Ivaldi's raptor_oraexec.sql in 2006 but has rarely been observed in the wild. The attacker compiled the khunt post-exploitation toolkit, consisting of six Java objects (KhuntCmd, KhuntHash, KhuntFS, KhuntFS2, KhuntT, KhuntUnzip) accessed via PL/SQL wrapper procedures stored as Oracle schema objects.
Using KhuntCmd, the attacker executed cmd.exe /c whoami through the Oracle JVM, confirming SYSTEM-level privileges on the Windows Server. All malicious process activity originated from the oracle.exe parent process, bypassing traditional EDR and antivirus tools that do not inspect Java classes and PL/SQL wrappers inside Oracle databases. The attacker then conducted credential theft using living-off-the-land Windows binaries: reg.exe to copy SECURITY and SYSTEM registry hives, and esentutl.exe to copy SAM and SECURITY hives, storing them as F:\Oracle\khunt*.hiv files. System service enumeration was performed via tasklist /svc, saved to F:\Oracle\khunttasks.txt. Huntress confirmed local staging of these files but could not establish whether exfiltration occurred.
The attacker's source IP was traced to 178.162.151.229 (LeaseWeb Netherlands B.V., AS60781) via Apache access.log analysis. No specific threat actor attribution was made. This intrusion is notable for the fileless deployment of post-exploitation tooling inside the Oracle database, the use of an Oracle JVM technique that has been publicly documented for two decades but rarely exploited in the wild, and the complete kill chain from SQL injection through database-to-OS escape to SYSTEM-level credential theft.
MITRE ATT&CK techniques used in TL-2026-1910
Credential Access
Discovery
T1007 System Service Discovery; T1033 System Owner/User Discovery; T1057 Process Discovery; T1082 System Information Discovery
Execution
T1059 Command and Scripting Interpreter; T1106 Native API
Defense Evasion
T1140 Deobfuscate/Decode Files or Information; T1564 Hide Artifacts
Initial Access
T1190 Exploit Public-Facing Application
Privilege Escalation
Affected products and versions in Attackers Compile khunt Toolkit Inside Oracle Database to
Remediation for Attackers Compile khunt Toolkit Inside Oracle Database to
Patches
- Apply latest Oracle Critical Patch Update
- Ensure Apache Tomcat is updated to latest stable version
Immediate actions
- Audit Oracle database accounts for excessive privileges including CREATE JAVA SOURCE, CREATE PROCEDURE, and CREATE ANY PROCEDURE
- Revoke CREATE JAVA SOURCE and CREATE ANY PROCEDURE from application database accounts
- Enable Oracle Unified Auditing for CREATE JAVA SOURCE, ALTER JAVA SOURCE, and DROP JAVA SOURCE DDL statements
- Review Apache access logs for connections from 178.162.151.229 and related LeaseWeb IP ranges
- Search Oracle schema objects and SQL audit logs for KHUNT% naming patterns and investigate any matches
- Deploy EDR rules monitoring oracle.exe spawning unexpected child processes (cmd.exe, powershell.exe, reg.exe, esentutl.exe)
Workarounds
- Restrict application database users to SELECT-only on required tables where possible
- Disable Oracle JVM component if not required for application functionality
- Implement Web Application Firewall (WAF) rules to block SQL injection patterns on autocomplete and search endpoints
- Segregate database accounts by application function with dedicated read-only accounts for public-facing services
- Apply OWASP Query Parameterization Cheat Sheet principles to all JDBC connections
Longer-term hardening
- Implement parameterized queries and prepared statements for all database-facing application endpoints via JDBC PreparedStatement
- Apply least privilege principle to all database service accounts — application accounts should not author Java sources or execute unrelated stored procedures
- Implement database activity monitoring (DAM) for anomalous SQL patterns including CREATE JAVA SOURCE from non-DBA accounts
- Establish regular audit of Java schema objects, PL/SQL wrappers, and stored procedures
- Deploy behavioral detection rules for LOLBins (reg.exe save, esentutl.exe /y) accessing SAM/SECURITY/SYSTEM registry hive paths
- Implement FalconForce FalconFriday detection pattern (0xFF-0209) for oracle.exe spawning unexpected child processes
Weaknesses (CWE) in Attackers Compile khunt Toolkit Inside Oracle Database to
Timeline of Attackers Compile khunt Toolkit Inside Oracle Database to
- Marco Ivaldi publishes raptor_oraexec.sql demonstrating Oracle JVM command execution via CREATE JAVA SOURCE — the same technique later used in the khunt intrusion, establishing a two-decade-old publicly documented PoC
- SYSTEM-level access confirmed via cmd.exe /c whoami executed through KhuntCmd; credential dumping artifacts (SAM/SECURITY/SYSTEM registry hive copies via reg.exe and esentutl.exe) identified in F:\Oracle\ directory; service enumeration output saved to khunttasks.txt
- Attacker source IP traced to 178.162.151.229 (LeaseWeb Netherlands B.V., AS60781) via Apache access.log analysis
- Khunt post-exploitation toolkit discovered as compiled Java schema objects (KhuntCmd, KhuntHash, KhuntFS, KhuntFS2, KhuntT, KhuntUnzip) inside the Oracle database, created via CREATE JAVA SOURCE — fileless, invisible to EDR/AV
- Investigation reveals SQL injection vulnerability in a public-facing Java/Tomcat application autocomplete search field as the initial access vector; SQL commands passed unvalidated via JDBC to Oracle database
- Huntress platform detects credential-theft alerts on a server hosting an Oracle database, triggering DFIR investigation
- Huntress publishes DFIR report 'Inside an Oracle Database SQL Injection Attack' documenting the full intrusion chain, including novel fileless khunt toolkit deployment inside Oracle JVM
- Public disclosure via The Hacker News, BleepingComputer, and IT Security Guru, amplifying detection and mitigation guidance to the security community
Sources cited for Attackers Compile khunt Toolkit Inside Oracle Database to
- Inside an Oracle Database SQL Injection Attack — Huntress
- Attackers Compile khunt Inside Oracle to Turn SQL Injection Into Windows SYSTEM Access — The Hacker News
- Hackers Run khunt Post-Exploitation Toolkit from Oracle Database — BleepingComputer
- raptor_oraexec.sql — Oracle JVM Command Execution via CREATE JAVA SOURCE — Exploit-DB
- raptor_oraexec.sql — 0xdea/exploits GitHub Repository
- FalconFriday 0xFF-0209 — Oracle Suspicious Command Execution Detection
- OWASP Query Parameterization Cheat Sheet
- Oracle Database SQL Language Reference — CREATE JAVA
Detection coverage for TL-2026-1910
As of 2026-08-06, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1910 across Splunk SPL, Microsoft KQL and Sigma, covering 13 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.