Threat Actors Exploit Oracle Database Scheduler to Infiltrate Corporate Networks

Threat actors have begun exploiting the Oracle Database Scheduler’s External Jobs feature to execute arbitrary commands on corporate database servers, enabling stealthy initial footholds and rapid escalation of privileges. By abusing the extjobo.exe executable, attackers can run encoded PowerShell commands, establish encrypted tunnels with Ngrok, and deploy ransomware, all while evading detection through aggressive cleanup routines.

In a recent incident response engagement, investigators discovered that attackers targeted an exposed Oracle Database instance by repeatedly attempting to connect as the SYS user, with initial logins failing and error code 28009 indicating valid credentials without the SYSDBA clause. The entry point detected was the use of a function of Oracle DBS, an exposed service active on the database server, which allowed remote command execution.

With these privileges, the threat actor invoked the Database Scheduler’s External Jobs component to listen on a named pipe and execute commands under the Scheduler service privileges, eventually staging a ransomware payload (“win.exe”) and a scheduled task named “Windows Update BETA” to run at system startup. Post-encryption, Ngrok was used to tunnel RDP traffic, and several tools and payloads were removed via delayed deletion commands to hinder forensic analysis.