GoKawiilHackers exploited a SQL injection vulnerability to install a post-exploitation toolkit directly inside an Oracle database that was used to breach a corporate network.
The attack was discovered by Huntress on July 27, 2026, after its security platform detected credential theft on a server hosting an Oracle database server.
Apache access logs showed that the attackers gained access through a vulnerable search engine endpoint in a public-facing Java application running Apache Tomcat.
The application failed to properly validate input submitted through an autocomplete search feature that allowed the attackers to issue SQL commands to the Oracle database.
Huntress traced the malicious requests to the IP address 178.162.151[.]229.
khunt Toolkit stored inside Oracle
After exploiting the SQL injection flaw, the attackers installed a post-exploitation toolkit called khunt directly into the Oracle database as a Java object.
Oracle has an embedded Java Virtual Machine and the CREATE JAVA SOURCE statement, which allows Java source code to be stored and compiled as a database schema object.
These Java objects can then be executed via SQL commands, which if configured to do so, can execute commands on the host operating system.
The attackers abused this functionality to compile and store the khunt toolkit directly inside the Oracle database rather than deploying them as executable files on the server.
... continue reading