Loading malware…
khunt is a Java-based, database-resident post-exploitation toolkit deployed within Oracle Database through its embedded JVM and Java source compilation capabilities. It is implanted as Java schema objects with PL/SQL wrappers, allowing an attacker with sufficiently privileged database access to invoke its functions through SQL without deploying a conventional executable payload. khunt provides arbitrary operating-system command execution, Oracle credential extraction, file-system browsing and searching, archive extraction, and installation or reachability checks. In a documented intrusion, it enabled a pivot from an Oracle database to SYSTEM-level execution on the underlying Windows server, followed by collection of Windows registry hives associated with credential dumping and service enumeration. The toolkit was delivered after SQL injection against a public-facing Java application connected to Oracle with an overprivileged JDBC account. Its database-resident design can reduce visibility to endpoint controls focused on files and conventional process execution. No named threat actor has been publicly attributed to the activity.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
23 distinct techniques documented for this family, organized by ATT&CK tactic.
Once compiled inside the database, the Java code could be run through SQL statements to execute operating system commands on the underlying host where Oracle was configured.
From there, they used PowerShell and Windows tools to copy the SAM, SECURITY, and SYSTEM registry hives, which could be used for credential dumping...
The toolkit included several modules with distinct roles: KhuntCmd for running Windows commands... The attackers even used KhuntCmd to run whoami, confirming SYSTEM-level execution on the Windows host.
The attack revolved around Khunt, a Java-based toolkit that attackers stored as a database object using Oracle’s “CREATE JAVA SOURCE” functionality.
From there, they used PowerShell and Windows tools to copy the SAM, SECURITY, and SYSTEM registry hives, which could be used for credential dumping...
Les attaquants ont ensuite copié les ruches de registre SAM, SECURITY et SYSTEM via PowerShell pour récupérer les hashes de comptes locaux.
KhuntHash —This tool goes straight into Oracle's internal user table and pulls out usernames and passwords, saving them to a file.
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A post-exploitation toolkit deployed inside an Oracle database by loading Java source code directly into the database engine, enabling attackers to operate through legitimate Oracle embedded Java functionality after initial access via SQL injection.
A post-exploitation toolkit implanted directly inside an Oracle database using Oracle Java functionality. Its modules support command execution, credential and hash extraction, file browsing/searching, installation testing, and unpacking compressed files, enabling host-level post-compromise activity from the database layer.
A fileless Oracle Database attack toolkit/technique in which attackers exploit SQL injection in an internet-facing application using JDBC, feed Java source code directly into Oracle's built-in Java compiler, create malicious stored schema objects inside the database, and execute OS-level commands with SYSTEM privileges on the underlying Windows server without dropping executable files to disk.
A fileless post-exploitation toolkit implanted directly inside an Oracle database as Java source/object code using Oracle's CREATE JAVA SOURCE feature. It enables OS command execution, Oracle password hash extraction, file system browsing and reading, connectivity testing, and archive extraction.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.