Microsoft SQL servers directly connected to the public internet have become the target of a targeted cyberattack campaign. FortiGuard Labs researcher Xiaopeng Zhang published the findings on November 12, detailing how attackers breached databases to mine Monero and install a remote-access trojan.
The malicious activity was detected starting in early October 2026. Attackers launched brute-force attacks by testing a list of more than 2,700 passwords paired with default usernames like ‘sa’ and ‘admin’.
Further trouble escalated once entry into the system was secured.
How Attackers Gained Shell Access
After breaching authentication, attackers ran database commands to enable a feature called xp_cmdshell. This feature provides a Windows command shell that can be executed directly from within SQL Server. By default, Microsoft disables this functionality because every executed command automatically inherits the high privileges of the system service account.
The attackers leveraged xp_cmdshell access to deploy a downloader. This downloader fetched payloads from the attackers’ server, including Monero crypto mining software and the Gh0st RAT remote-access trojan.
Edge Update Disguise and Two Malware Payloads
The first payload was a Monero miner disguised under the filename MicrosoftEdgeUpdate.exe. This disguised file ran the XMRig software to hijack the victim machine’s CPU capacity. Inside the miner’s code, researchers discovered a configuration containing one Monero crypto wallet address and three mining pool addresses.
The second payload was planted using the filename winlogon.exe. This file is a Gh0st RAT variant granting attackers the ability to log keystrokes, manipulate files, and execute remote commands. Attackers could also enable additional plugin modules to provide screen recording and remote desktop capabilities.
Persistence Tactics Scheduled Every Thirty Minutes
To ensure the programs survived system reboots, the attackers established persistence across three areas of the Windows environment. They set up persistence via Windows registry entries, a Windows service installation, and a scheduled task configured to run automatically every 30 minutes.
When the FortiGuard Labs research team performed forensic analysis, the hackers’ command-and-control (C2) server was reportedly inactive. However, for database administrators with servers on public networks, the attack serves as a stark reminder of the dangers of leaving default passwords unsecured and privileged shell features enabled.
Reported via crypto.news.
Read also: Coinkite Blames Human Limitations After $116M Coldcard Breach - Developer Reveals May 2025 Warning
Disclaimer: This article is for informational and educational purposes only, not financial advice. Cryptocurrency assets are highly volatile and carry significant risk. Always do your own research (DYOR) and never invest more than you can afford to lose.
