Toolkit Installation via SQL Injection Shows the Classics Still Hit
See how a SQL injection bug led to full OS-level RCE, as attackers abused Oracle Java Source to deploy the khunt post-exploitation toolkit.
Transforming curiosity into cyber defense, one line of code at a time.
Michael Tigges is a Principal Tactical Response Analyst at Huntress, where he puts his passion for reverse engineering, threat detection, and partner support into practice. His interest in cybersecurity took off when he began learning Python and dissecting malware lurking in open-source software channels. Today, he holds a B.S. in Cybersecurity from the SANS Technology Institute and a host of certifications, including GPEN, GCFE, GCFA, GCIA, and GCIH.
Before joining Huntress, Michael worked in financial risk analysis for enterprise banking and served eight years of Active Duty in the U.S. Air Force munitions career field, bringing a unique blend of analytical skill, discipline, and operational insight to his role. What he loves most about Huntress is the open atmosphere: “There’s always something interesting going on to learn from,” he says, whether it’s threat intel specialists forming a cohesive threat picture, reverse engineers dissecting malware, or account managers supporting valued partners.
What’s your favorite cybersecurity tip, Michael?
“Never click promotional email links; figure out where they go and navigate yourself. When typing out that domain, you may find it doesn't say what you think it does.”
Outside of work, Michael invests his time in gaming, software engineering, and exploring open-source security projects. He also shares his insights on his personal blog (sudorem.dev) and on X: @sudo_Rem.
See how a SQL injection bug led to full OS-level RCE, as attackers abused Oracle Java Source to deploy the khunt post-exploitation toolkit.
On July 21 and July 22, Huntress observed a number of attacks that started with a malicious public Claude Artifact hosted on a legitimate Claude domain, and ended in organizations being infected by the SectopRAT stealer.
Huntress has observed a series of strikingly similar intrusions beginning with CitrixBleed 2 exploitation, employing novel local privilege escalation techniques, and ending in Dragonforce ransomware.
Huntress observed in-the-wild use of Nightmare-Eclipse tooling, including BlueHammer, RedSun, and UnDefend, in a live intrusion involving FortiGate VPN compromise as the initial access, reconnaissance commands, and likely tunneling activity.
Fake tech support scams used to end with a gift card. Now they end with a modified Havoc C2 framework in your environment, using indirect syscalls to dodge your EDR.
ClickFix delivered the initial access, Matanbuchus did the loading, and a new RAT handled the rest. This February 2026 intrusion has all the ingredients of a campaign that isn't slowing down.
We’re hosting a session on making hackers’ work harder for them. Join us to learn practical, battle-tested hardening guidance to stop attackers in their tracks and turn your environment into one that’s straight-up hostile to threat actors.