Attackers Exploit Oracle’s Embedded Java VM to Hide Malware Inside Databases
Security researchers at Huntress uncovered a sophisticated attack campaign where threat actors leveraged Oracle Database’s embedded Java Virtual Machine (OJVM) to conceal and execute malicious code directly within compromised databases. The incident, discovered during an investigation into credential theft on an Oracle server, revealed an evolved exploitation technique that bypasses traditional detection methods.
Instead of relying solely on SQL injection for data extraction, attackers abused Oracle’s CREATE JAVA SOURCE functionality to upload, compile, and execute a custom Java-based toolkit dubbed Khunt as a stored database object. This allowed them to establish persistence and execute operating system commands on the underlying Windows host via SQL statements, all while blending into legitimate database operations.
The attack chain began with a classic SQL injection vulnerability in a public-facing application, which granted initial access to Oracle’s PL/SQL environment. From there, attackers escalated privileges to SYSTEM-level access, enabling them to dump Windows registry hives (SAM, SECURITY, SYSTEM) and extract local account password hashes. Huntress noted that the malware’s concealment within the database schema made it significantly harder to detect, as it avoided noisy external binaries and operated entirely through Oracle’s native capabilities.
Key indicators of compromise (IOCs) shared by Huntress include malicious Java artifacts, suspicious SQL statements, and file hashes associated with the Khunt toolkit. The firm emphasized that while SQL injection provided the initial foothold, the critical risk lay in the post-exploitation abuse of Oracle’s embedded Java features highlighting the need for stricter privilege controls and secure coding practices to prevent such attacks.
Oracle has not yet responded to requests for comment. The incident underscores the growing threat of attackers weaponizing built-in database functionalities to evade detection and maintain long-term access.
Oracle TPRM report: https://www.rankiteo.com/company/oracle
"id": "ora1786019038",
"linkid": "oracle",
"type": "Cyber Attack",
"date": "8/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'type': 'Organization'}],
'attack_vector': 'SQL Injection',
'data_breach': {'personally_identifiable_information': 'Potential (if local '
'accounts included '
'PII)',
'sensitivity_of_data': 'High (password hashes, system '
'credentials)',
'type_of_data_compromised': 'Windows registry hives (SAM, '
'SECURITY, SYSTEM), local account '
'password hashes'},
'description': 'Security researchers at Huntress uncovered a sophisticated '
'attack campaign where threat actors leveraged Oracle '
'Database’s embedded Java Virtual Machine (OJVM) to conceal '
'and execute malicious code directly within compromised '
'databases. The incident revealed an evolved exploitation '
'technique that bypasses traditional detection methods by '
'abusing Oracle’s CREATE JAVA SOURCE functionality to upload, '
'compile, and execute a custom Java-based toolkit (Khunt) as a '
'stored database object. This allowed persistence and OS '
'command execution via SQL statements while blending into '
'legitimate database operations.',
'impact': {'data_compromised': 'Windows registry hives (SAM, SECURITY, '
'SYSTEM), local account password hashes',
'identity_theft_risk': 'High (due to password hash extraction)',
'operational_impact': 'Potential unauthorized OS command '
'execution, persistence within database '
'schema',
'systems_affected': 'Oracle Database servers with embedded Java VM '
'(OJVM), underlying Windows hosts'},
'initial_access_broker': {'backdoors_established': 'Khunt toolkit deployed as '
'a stored database object',
'entry_point': 'SQL Injection in public-facing '
'application',
'high_value_targets': 'Oracle Database servers with '
'SYSTEM-level access'},
'investigation_status': 'Ongoing (as of disclosure)',
'lessons_learned': 'Attackers can weaponize built-in database functionalities '
'(e.g., Oracle’s embedded Java VM) to evade detection and '
'maintain persistence. Stricter privilege controls and '
'secure coding practices are needed to prevent such '
'attacks.',
'post_incident_analysis': {'corrective_actions': 'Restrict CREATE JAVA SOURCE '
'functionality, enforce '
'least-privilege access, '
'monitor for suspicious SQL '
'activity, patch SQL '
'injection vulnerabilities',
'root_causes': 'SQL Injection vulnerability in '
'public-facing application, abuse '
'of Oracle’s embedded Java VM '
'(OJVM) for malware concealment, '
'insufficient privilege controls'},
'recommendations': 'Implement stricter privilege controls for database users, '
'monitor and restrict usage of Oracle’s CREATE JAVA SOURCE '
'functionality, enhance detection for suspicious SQL '
'statements, and adopt secure coding practices to prevent '
'SQL injection vulnerabilities.',
'references': [{'source': 'Huntress'}],
'response': {'third_party_assistance': 'Huntress (security researchers)'},
'title': 'Attackers Exploit Oracle’s Embedded Java VM to Hide Malware Inside '
'Databases',
'type': 'Malware Deployment',
'vulnerability_exploited': 'SQL Injection in public-facing application, '
'privilege escalation to SYSTEM-level access in '
'Oracle Database, abuse of Oracle’s CREATE JAVA '
'SOURCE functionality'}