SQL Injection Used to Deploy 'khunt' Post-Exploitation Toolkit Inside Oracle Database

What happened

According to BleepingComputer, attackers exploited a SQL injection vulnerability to install a post-exploitation toolkit called khunt directly inside an Oracle database. The compromised database reportedly served as the initial foothold used to breach a corporate network. Specific details on the vulnerable application, the affected organization, and the threat actor's identity have not been disclosed in the reporting available at this time.

Why it matters

Databases are frequently treated as trusted internal infrastructure with limited monitoring compared to endpoints, making them an attractive place for attackers to stage tooling. Running a post-exploitation toolkit from within an Oracle database — rather than on a standard endpoint — can help adversaries blend into normal database activity and evade traditional EDR coverage, which typically does not extend into database engines. Organizations running internet-facing or otherwise exposed Oracle instances, especially those with custom or legacy applications vulnerable to SQL injection, should consider this a relevant threat model.

What defenders should watch for

• Audit database-facing applications for SQL injection vulnerabilities, particularly those with direct or indirect exposure to the internet.
• Review Oracle database audit logs for anomalous use of PL/SQL procedures, external procedure calls, Java stored procedures, or OS-command-execution features (e.g. DBMS_SCHEDULER, Java-in-the-database, or external table/file operations) that could indicate a toolkit being staged or executed.
• Monitor for unexpected outbound network connections originating from database servers, which are unusual for typical database workloads.
• Ensure database servers are included in endpoint/host monitoring and log forwarding, not just treated as a data store outside EDR visibility.
• Apply least-privilege database account configurations and disable unused stored-procedure or OS-interaction features where not required.

Developing story

This is a net-new report and technical specifics — including the exact SQL injection flaw, the scope of the intrusion, and attribution — have not yet been fully detailed publicly. df00tech will continue monitoring for further reporting. Read the original coverage from BleepingComputer here: Hackers run khunt post-exploitation toolkit from Oracle database.