Post-exploitation toolkit hidden inside Oracle database evades endpoint detection

Security researchers have disclosed a sophisticated post-exploitation toolkit that attackers compiled and executed entirely inside an Oracle database, bypassing traditional endpoint detection tools. Infosecurity Magazine reports that attackers used SQL injection to gain initial access, then compiled the toolkit—dubbed Khunt—directly within the database environment using Oracle's built-in PL/SQL and Java capabilities. The toolkit included functionality for credential harvesting, lateral movement, data exfiltration and persistence, all executed without touching the host operating system in ways that endpoint detection and response (EDR) tools would typically monitor. The technique demonstrates how attackers are increasingly exploiting the trusted execution environments of enterprise applications to evade detection. By operating entirely within the database engine, the attackers were able to maintain persistence, escalate privileges and move laterally without generating the telemetry that most security tools rely on.

Why this matters for UK organisations

For UK organisations running Oracle databases or other enterprise database platforms, this matters because it highlights a detection gap that many security teams may not have considered. Most endpoint security tools focus on monitoring processes, file system activity and network connections at the operating system level. Activity that occurs entirely within a database engine—particularly when using legitimate database features like stored procedures, triggers or Java execution—may not generate the telemetry that security tools expect. This is particularly concerning for organisations that rely heavily on database-driven applications, where the database itself may have extensive network access, privileged credentials and direct access to sensitive data. The attack also underscores the importance of securing SQL injection vulnerabilities, which remain a common and high-impact entry point. Once inside the database, attackers can leverage built-in functionality to achieve objectives that would normally require malware or tools deployed on the host operating system. This makes detection significantly harder and increases the dwell time attackers have to achieve their objectives.

What to review

For organisations running Oracle or other enterprise databases, this is a prompt to review whether database activity logging is enabled, monitored and integrated into your security operations. Consider whether your security team has visibility into unusual stored procedures, Java execution, or privilege escalation within the database environment, and whether database administrators are trained to recognise signs of compromise. Ensure that SQL injection vulnerabilities are prioritised in application security testing and remediation efforts, and that web application firewalls or runtime application self-protection (RASP) tools are in place where appropriate. Review whether database audit logs are retained, analysed and correlated with other security telemetry, and whether your incident response team has the skills and tools to investigate database-level compromises. This is also a prompt to consider whether your organisation has a clear process for reviewing and approving stored procedures, triggers and other database-level code, and whether changes to database configurations are subject to change control and monitoring.

Source: Infosecurity Magazine