Loading story…
Attackers exploited a classic SQL injection flaw in a public-facing Java application on Apache Tomcat to compromise an Oracle database server and deploy a custom post-exploitation toolkit, khunt, directly inside the database. Huntress reported that the intruders abused Oracle's CREATE JAVA SOURCE capability and embedded JVM to upload and compile Java modules as database objects, then exposed them through PL/SQL wrappers. The toolkit provided operating system command execution, file access, archive extraction, installation checks, and credential access from Oracle user tables, turning the database itself into a stealthy execution platform rather than limiting the intrusion to data theft or manipulation.
The attackers then pivoted from the Oracle database to the underlying Windows host and executed commands with SYSTEM-level privileges, enumerated running services, and copied the SAM, SECURITY, and SYSTEM registry hives using PowerShell and native Windows tools, indicating likely preparation for credential dumping and broader lateral movement. Huntress said the activity was detected after credential-theft behavior was observed on July 27 and linked initial access to requests from 178.162.151[.]229, warning that database-resident Java classes and PL/SQL objects can create a detection blind spot for many endpoint security tools if public-facing applications retain excessive database privileges.
See affected versions and whether adversaries are exploiting it.
7 events from the most recent confirmed update back to the earliest known activity.
On 2026-08-06, Huntress published a detailed incident response report describing the SQL-injection-to-Oracle attack chain, including use of the khunt toolkit and fileless Java-based post-exploitation inside Oracle. The report highlighted abuse of CREATE JAVA privileges and OS command execution from the database on Windows hosts.
On 2026-07-27, Huntress investigated suspicious activity on an endpoint hosting the Oracle database server and detected credential-theft-related activity, including attempts to copy the SAM, SECURITY, and SYSTEM registry hives. This investigation led to discovery of the broader intrusion chain.
Huntress shared indicators of compromise for the Oracle intrusion, including file hashes, malicious Java artifacts, SQL statements, and search terms. The firm also advised defenders to inspect Oracle environments for unexpected Java source objects, compiled Java classes, and stored procedures tied to OJVM abuse.
Following the pivot to Windows, the attackers used PowerShell and native Windows tools to copy the SAM, SECURITY, and SYSTEM registry hives and ran tasklist /svc to enumerate running services. Outputs were saved on the compromised host, indicating likely preparation for credential dumping or further post-compromise activity.
Using khunt's command-execution functionality, the attackers ran operating system commands from the Oracle database on the underlying Windows server. A whoami command confirmed the activity was executing with SYSTEM-level privileges.
After gaining database access, the attackers used Oracle's CREATE JAVA SOURCE capability to upload and compile a custom Java-based post-exploitation toolkit named khunt directly inside the database engine. The toolkit was stored as Oracle schema objects with PL/SQL wrappers for execution.
Attackers abused an input-validation flaw in a public-facing web application, including a vulnerable autocomplete/search feature in a Java application on Apache Tomcat, to execute SQL against an Oracle database. Huntress traced malicious requests to IP address 178.162.151[.]229.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
10 references tracked. Mallory keeps watching after this page renders.
theregister.com
Open sourcecert.ug
Open sourcecyberveille.ch
Open sourceinfosecurity-magazine.com
Open sourcethehackernews.com
Open sourcebleepingcomputer.com
Open sourceitsecurityguru.org
Open sourcehuntress.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A threat actor exploited an **SQL injection** flaw in a web page at a technology-sector organization, compromising an endpoint running **IIS** and **Microsoft SQL Server** and then carrying out extensive post-exploitation activity. Huntress reported the attacker used **base64-encoded PowerShell** for payload delivery, ran reconnaissance including `tasklist /svc`, and exfiltrated process information to an **OAST** domain. The actor then enabled **Remote Desktop Services**, created a new local administrator account named `adminweb2$`, and attempted to disable **Windows Defender** to retain access and reduce detection. The intrusion escalated into broad persistence and monetization efforts on the same host. The attacker installed known **BadIIS** modules using `appcmd.exe`, downloaded the **XMRig** cryptocurrency miner, hid miner-related files with `attrib.exe`, and used `nssm.exe` to keep the miner running persistently. Additional payloads included PowerShell and batch files such as `qdcjoke1.2.ps1`, `c_joke1.2.ps1`, and `qd_tjoke.bat`, along with **CnCrypt Protect**, likely for defense evasion. Huntress said the case stood out for the volume of system changes made after the initial compromise and warned that remediation must address the original SQL injection weakness to prevent re-entry.
Jul 13, 2026
Attackers began exploiting **Oracle WebLogic Server** vulnerability `CVE-2026-21962` almost immediately after public proof-of-concept code was posted, according to observations from a high-interaction honeypot emulating an unpatched **WebLogic Server 14.1.1.0.0** instance. The flaw is a **CVSS 10.0** unauthenticated remote code execution issue in the WebLogic Console, and researchers recorded active exploitation attempts over a 12-day period, showing how quickly newly disclosed enterprise software vulnerabilities can be operationalized. The activity was largely automated and opportunistic, with scans and exploit attempts originating mainly from rented VPS infrastructure including **DigitalOcean** and **HOSTGLOBAL.PLUS**. Researchers also observed continued abuse of older WebLogic flaws such as `CVE-2020-14882`, `CVE-2020-14883`, `CVE-2020-2551`, and `CVE-2017-10271`, alongside probes for unrelated weaknesses in **Hikvision** devices and **PHPUnit**, indicating a broad spray-and-pray campaign. Common tooling included **libredtail-http** and the **Nmap Scripting Engine**, while defenders were urged to apply Oracle patches, restrict internet exposure of the administrative console, deploy a **WAF**, and monitor for suspicious activity including `wget` or `curl` execution.
Jun 29, 2026
Oracle E-Business Suite was recently found to be vulnerable to a critical security flaw, CVE-2025-61882, which has been actively exploited in the wild. Oracle published a security bulletin disclosing the vulnerability, providing a patch, and sharing indicators of compromise observed during incident response. Attackers leveraged a Python-based exploit script, referred to as 'exp.py', which automates the exploitation process by interacting with specific endpoints in Oracle E-Business Suite. The script initiates by sending a GET request to '/OA_HTML/runforms.jsp' to determine the internal host, followed by a POST request to '/OA_HTML/JavaScriptServlet' to retrieve a CSRF token required for further exploitation. The final exploit request is sent to '/OA_HTML/configurator/UiServlet', with a crafted payload designed to trigger the vulnerability. Analysis of attack logs reveals that the initial exploitation is followed by the dropping of malicious template files onto the target system. These templates are then activated by previewing them, which triggers further malicious activity. Apache logs from compromised systems show a sequence of GET and POST requests to endpoints such as '/OA_HTML/OA.jsp?page=/oracle/apps/xdo/oa/template/webui/TemplateCopyPG' and '/OA_HTML/OA.jsp?page=/oracle/apps/xdo/oa/template/webui/TemplateFileAddPG', indicating the deployment and activation of these templates. Two distinct types of malicious templates have been identified. The first type contacts a hardcoded command-and-control (C2) IP address and executes arbitrary Java code within the context of the Oracle WebLogic server, allowing attackers to maintain persistence without dropping additional files to disk. This template retrieves the HTTP response object, sends data back to the attacker, and establishes a connection to the C2 server using a custom protocol string, then loads and executes a Java class received from the C2 server after decrypting it. The second template type embeds a Java class file directly within the template, which is decoded and executed upon activation. This template installs a backdoor that enables attackers to send specially crafted POST requests to a specific endpoint ('/support/state/content/destination./navId.1/navvSetId.iHelp/') to execute arbitrary Java code remotely. Both template types use base64 encoding to obfuscate their payloads, which are decoded and executed in memory, making detection and forensic analysis more challenging. The exploitation chain demonstrates a sophisticated understanding of Oracle E-Business Suite internals and leverages multiple stages to achieve code execution and persistence. Oracle's response included the release of a patch and detailed indicators of compromise, such as specific HTTP request patterns and file artifacts, to aid defenders in identifying affected systems. Security researchers have provided in-depth technical analyses of the exploit script and the malicious templates, highlighting the importance of monitoring for unusual template file activity and suspicious HTTP requests in Oracle E-Business Suite environments. The attack underscores the critical need for organizations to apply security patches promptly and to monitor for signs of exploitation, especially in widely deployed enterprise applications like Oracle E-Business Suite. The use of in-memory execution and custom C2 protocols further complicates detection and response efforts. Organizations are advised to review Oracle's security bulletin, apply the provided patch, and search for the published indicators of compromise to ensure their environments are not affected by this active threat.
Jun 29, 2026