Hackers deploy post-exploitation toolkit via Oracle database flaw

Security researchers identified a novel attack vector where hackers leveraged a SQL injection vulnerability in an Oracle database to deploy a post-exploitation toolkit. The incident targeted a corporate network, allowing attackers to install the khunt toolkit directly within the database environment itself.

What happened

The breach occurred when attackers exploited an unpatched SQL injection flaw in an Oracle database instance. Rather than using the database as a mere entry point, the hackers installed the khunt post-exploitation toolkit inside the database, turning it into a command-and-control platform. This approach allowed persistent access to the compromised network while evading detection by traditional security tools focused on file-based threats.

The khunt toolkit, designed for post-exploitation activities, enabled the attackers to maintain access, exfiltrate data, and move laterally within the network. While the specific victim organization remains undisclosed, the attack demonstrates a shift in tactics—using database infrastructure as both a target and a launchpad for further compromise.

What we don’t know yet

Sources did not specify the version of Oracle Database targeted, the timeline of the breach, or whether the victim organization detected the intrusion internally or through third-party investigation. The identity of the threat actor and the ultimate objectives of the attack also remain unclear. No details were provided about the scale of data accessed or exfiltrated during the incident.