Attackers hid malware inside Oracle Database after SQL injection breach
Summary
Attackers have been observed hiding a custom post-exploitation toolkit named Khunt within an Oracle database by exploiting a SQL injection vulnerability. They leveraged the database's built-in Java Virtual Machine to upload, compile, and execute malicious Java code directly from within the database, allowing them to maintain persistence and blend in with legitimate operations.
IFF Assessment
This article details a sophisticated technique where attackers compromise systems by abusing database features for persistence and execution, posing a significant threat to defenders.
Defender Context
This incident highlights the evolving tactics of attackers who are weaponizing legitimate database features like Oracle's embedded Java Virtual Machine. Defenders need to be vigilant about unusual database activity and ensure robust input validation to prevent SQL injection, as it can lead to much deeper system compromise than previously assumed.