Attackers hid malware inside Oracle Database after SQL injection breach

Attackers have been found to hide malware within Oracle Database by exploiting SQL injection vulnerabilities, allowing them to store custom toolkits like Khunt inside the database using Java capabilities. This approach enables threat actors to maintain persistence and evade detection, as the malware resides within the database itself. The discovery was made by Huntress after investigating credential theft on a server running Oracle Database, revealing a sophisticated campaign where attackers leveraged SQL injection to host their malicious toolkit. The use of Java capabilities within the Oracle database facilitated the storage of the Khunt toolkit, highlighting the potential for databases to be used as malware hosts¹. This matters to security practitioners because it underscores the need to scrutinize database security and monitor for unusual activity, as traditional detection methods may not identify malware residing within a database.