Threat Intelligence Brief
Curated summary with source attribution
Source: thehackernews.com
Threat Risk: High
Victim: Organization utilizing Oracle Database
Incident: SQL injection used to deploy the ‘khunt’ toolkit for Windows SYSTEM privilege escalation.
Impact: Full compromise of the underlying Windows server and theft of sensitive registry hives (SAM, SECURITY, SYSTEM).
Attacker: Unidentified threat actors
Analysis: The attack chain leverages a SQL injection flaw in a public-facing web application to exploit the Oracle embedded JVM. By creating Java source objects directly within the database schema, threat actors can execute OS-level commands without writing binaries to disk. This technique effectively bypasses traditional EDR tools that do not monitor Oracle’s internal schema objects.
Recommendations: Implement parameterized queries and strict input validation to eliminate SQL injection vulnerabilities.; Apply the principle of least privilege by disabling CREATE PROCEDURE and Java source permissions for application-facing database accounts.; Audit Oracle database schema objects and SQL logs for suspicious entries matching ‘Khunt’ or ‘KHUNT%’.
Source: The Hacker News / Huntress
Editorial note: this post summarizes third-party reporting and links to the original source.
View Original Source