The Database Was the Door: A Ransomware Attack Began with an Exposed Oracle Serve

Yarix’s Incident Response Team (YIR) has published an in-depth analysis of a targeted intrusion that began with repeated login attempts against an Oracle Database Server. According to Yarix, the entry point detected was the use of a function of Oracle DBS, an exposed service active on the database server, which allowed the execution of commands remotely. Logs showed the attacker authenticated with elevated SYSDBA privileges after a period of failed logins, suggesting the use of valid credentials.

The intruder then used Oracle’s External Jobs Scheduler (extjobo.exe) to execute commands with system-level privileges, dropping batch scripts and running Base64-encoded PowerShell commands that reached a C2 server. Investigators found a payload downloaded from 80.94.95[.]227:5555 and evidence linking to public GitHub code for TCP reverse shells, with Ngrok subsequently deployed to establish an encrypted HTTPS tunnel for covert, persistent access via RDP.

The attackers created a new local Admine$ account in the administrators group, staged ransomware, and, after encryption with a file at C:\PerfLogs\win.exe, generated ransom notes named Elons_Help.txt and attempted to erase traces by purging recycle bins.