Ankura CTIX FLASH Update – August 10, 2026

Malware Activity

Oracle Database Abuse and Blockchain-Based Malware Reveal New Evasion Tactics

Researchers have identified two (2) sophisticated cyberattack techniques that highlight how threat actors are increasingly abusing legitimate technologies to stay hidden. In the first case, attackers exploited a SQL injection vulnerability in a public-facing application connected to an Oracle database and used Oracle’s built-in Java functionality to create and store a custom toolkit called khunt directly inside the database. This allowed them to execute system commands, access files, harvest credentials, and ultimately gain SYSTEM-level access on a Windows server while avoiding many traditional endpoint security controls. In a separate campaign linked to North Korean threat actors, malicious npm packages were found using a new malware technique called NullReceiver, which hides command-and-control (C2) infrastructure inside Ethereum blockchain transactions rather than embedding server