Oracle Database Abuse and Blockchain-Based Malware Reveal New Evasion Tactics

Researchers have identified two (2) sophisticated cyberattack techniques that highlight how threat actors are increasingly abusing legitimate technologies to stay hidden. In the first case, attackers exploited a SQL injection vulnerability in a public-facing application connected to an Oracle database and used Oracle’s built-in Java functionality to create and store a custom toolkit called khunt directly inside the database. This allowed them to execute system commands, access files, harvest credentials, and ultimately gain SYSTEM-level access on a Windows server while avoiding many traditional endpoint security controls. In a separate campaign linked to North Korean threat actors, malicious npm packages were found using a new malware technique called NullReceiver, which hides command-and-control (C2) infrastructure inside Ethereum blockchain transactions rather than embedding server addresses in code. By retrieving and decoding blockchain transaction data, the malware could secretly locate attacker-controlled systems, making detection significantly more difficult. Together, these incidents demonstrate a growing trend of attackers leveraging trusted enterprise platforms and decentralized technologies to evade security monitoring, underscoring the importance of secure application development, stronger access controls, continuous monitoring, and proactive threat hunting across databases, software supply chains, and cloud-connected environments. CTIX analysts will continue to report on the latest malware strains and attack methodologies.