Attackers Compile khunt Inside Oracle to Turn SQL Injection Into Windows SYSTEM Access

Attackers entered an organization’s Oracle database through SQL injection in a public-facing web application. They supplied Java source code to the database, had Oracle compile it into schema objects, and ran commands from inside the database engine. Huntress tracked the toolkit as khunt and linked the activity to SYSTEM-level code execution on the underlying Windows server.