Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

Apache Tomcat Oracle SQL injection flaw under active exploitation

Vulnerability
First reported
Last updated
Happening score
H score 49
2 unique sources, 2 articles

Summary

Hide ▲

SQL injection in a public-facing Java application running Apache Tomcat let attackers reach an Oracle database and load the khunt toolkit as database-stored Java objects rather than as files on disk. Huntress tied the activity to July 27, 2026, after credential-theft detections fired and requests were traced to 178.162.151[.]229. The attackers used KhuntCmd to run cmd.exe /c whoami and confirmed SYSTEM-level access on the underlying Windows server. They also used the toolkit to browse files, read hashes, and stage the SAM, SECURITY, and SYSTEM registry hives, while Huntress did not confirm exfiltration.

Related Happenings

Khunt Oracle database post-exploitation toolkit analysis

Technical Analysis
H score22 First: 06.08.2026 18:30 Last: 06.08.2026 18:30 Sources 1

About this happening: Researchers found khunt compiled and stored as Oracle schema objects, turning the database into a stealthy platform for command execution and credential dumping on...

Open Happening

June Huntress post-breach analysis of Windows server persistence, BadIIS, and miner deployment

Technical Analysis
H score22 First: 30.07.2026 17:01 Last: 30.07.2026 17:01 Sources 1

About this happening: A June Huntress investigation reconstructed an attacker’s post-breach hardening on a single Windows server, showing how a compromise can turn into long-lived access an...

Open Happening

Estée Lauder Oracle E-Business Suite personal information leak

Data Leak
H score72 First: 21.07.2026 01:39 Last: 21.07.2026 01:39 Sources 1

About this happening: A data leak exposed sensitive personal records tied to Estée Lauder after unauthorized access to its Oracle E-Business Suite used for HR management. The company sa...

Open Happening

CISA BOD 26-04 Oracle EBS patch order

Public Sector Action
H score38 First: 16.07.2026 13:56 Last: 16.07.2026 13:56 Sources 1

About this happening: CISA ordered U.S. government agencies to patch vulnerable Oracle E-Business Suite instances by Saturday, July 18, tightening federal exposure to an actively expl...

Open Happening

IT services firm in South Asia hit by ransomware attack

Incident
H score31 First: 16.07.2026 13:00 Last: 16.07.2026 13:00 Sources 1

About this happening: The IT services firm in South Asia suffered a Spirals ransomware intrusion that moved from initial access to data theft and encryption in less than 24 hours, putti...

Open Happening

Timeline

  1. 05.08.2026 22:55 1 articles · 1d ago

    Credential theft is detected on an Oracle database server

    Detection Ioc Update

    Huntress detected credential theft on July 27, 2026 on a server hosting an Oracle database server after Apache access logs showed attackers reached a vulnerable search engine endpoint and autocomplete search feature in a public-facing Java application running Apache Tomcat. The requests were traced to 178.162.151[.]229, and the SQL injection path let the attackers issue SQL commands to the Oracle database.

    Show sources
    Open in new tab
  2. 05.08.2026 22:55 3 articles · 1d ago

    khunt is embedded directly inside Oracle as a Java object

    Technical Analysis Update

    Huntress detailed that after SQL injection, the attackers stored the khunt toolkit directly inside Oracle as a Java object rather than deploying executable files on the server, then used KhuntCmd to run cmd.exe /c whoami and confirm SYSTEM-level permissions on the Windows server. The toolkit also included KhuntHash for writing usernames and password data, KhuntFS and KhuntFS2 for file browsing and search, KhuntT for installation checks, and KhuntUnzip for extracting compressed files; the attackers also copied the SAM, SECURITY, and SYSTEM registry hives and ran tasklist /svc to enumerate services.

    Show sources
    Open in new tab