Loading malware…
Khunt is a Java-based, database-resident post-exploitation toolkit used in Oracle Database intrusions. It is implanted as Java source and compiled schema objects inside Oracle through the platform’s embedded JVM and CREATE JAVA SOURCE functionality, allowing attackers to avoid dropping conventional executable payloads to disk and reducing visibility to security tools focused on files, binaries, and standard endpoint telemetry. Documented use involved exploitation of SQL injection in a public-facing Java application connected to Oracle over JDBC, where an overprivileged database account enabled creation of malicious Java objects and subsequent execution of operating system commands on the underlying host.
The toolkit includes modules for arbitrary Windows command execution, extraction of Oracle usernames and password data from internal database tables, file-system browsing and reading, archive extraction, connectivity testing, and PL/SQL wrappers that invoke the embedded Java methods. In observed activity, operators used Khunt to pivot from the Oracle database layer to the underlying Windows server, confirm SYSTEM-level execution, enumerate services, and stage Windows registry hives associated with credential dumping. This demonstrates that Oracle can be abused not only as a data store but also as a stealthy foothold for host-level compromise.
Khunt has been observed against Oracle environments supporting internet-facing applications, particularly where JDBC-connected accounts possess excessive privileges such as the ability to create Java objects or invoke dangerous stored procedures. No specific threat actor attribution is established from the available information. The technique is notable for combining a common initial access vector with legitimate Oracle functionality to achieve persistence, credential theft, post-exploitation, and defense evasion within the database engine itself.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
24 distinct techniques documented for this family, organized by ATT&CK tactic.
Once compiled inside the database, the Java code could be run through SQL statements to execute operating system commands on the underlying host where Oracle was configured.
Les attaquants ont ensuite copié les ruches de registre SAM, SECURITY et SYSTEM via PowerShell pour récupérer les hashes de comptes locaux.
Its components included a module that opened a Windows command shell for arbitrary operating system commands.
The attacker fed that statement through the injection point, and Oracle compiled the code into stored schema objects.
The attack revolved around Khunt, a Java-based toolkit that attackers stored as a database object using Oracle’s “CREATE JAVA SOURCE” functionality.
With that level of access, they were able to dump the Windows SAM, SECURITY, and SYSTEM registry hives, enabling offline extraction of local account password hashes.
Les attaquants ont ensuite copié les ruches de registre SAM, SECURITY et SYSTEM via PowerShell pour récupérer les hashes de comptes locaux.
KhuntHash —This tool goes straight into Oracle's internal user table and pulls out usernames and passwords, saving them to a file.
The attackers then used PowerShell and reg.exe to copy the SECURITY and SYSTEM registry hives into F:\Oracle, ran tasklist /svc into khunttasks.txt
Running cmd.exe /c whoami through KhuntCmd returned SYSTEM.
1 indicator attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A fileless Oracle Database attack toolkit/technique in which attackers exploit SQL injection in an internet-facing application using JDBC, feed Java source code directly into Oracle's built-in Java compiler, create malicious stored schema objects inside the database, and execute OS-level commands with SYSTEM privileges on the underlying Windows server without dropping executable files to disk.
A fileless post-exploitation toolkit implanted directly inside an Oracle database as Java source/object code using Oracle's CREATE JAVA SOURCE feature. It enables OS command execution, Oracle password hash extraction, file system browsing and reading, connectivity testing, and archive extraction.
A post-exploitation toolkit compiled and stored inside Oracle database schema objects via embedded Java, enabling attackers to execute Windows commands from within the database server and dump Oracle credentials while evading conventional endpoint inspection.
A custom Java-based post-exploitation toolkit hidden inside an Oracle database using the embedded Java Virtual Machine, enabling attackers to upload, compile, and execute malicious code from within the database, maintain persistence, execute OS commands, and support credential theft and SYSTEM-level compromise of the underlying Windows host.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.