Cyberattack Campaign Exploits Weak Microsoft SQL Server Passwords to Deploy Malware
A significant and alarming cyber campaign has recently emerged, targeting internet-facing Microsoft SQL Server instances that are vulnerable due to weak password protections. The campaign, identified by FortiGuard Labs — the research arm of cybersecurity firm Fortinet — is notable for its dual deployment of a Monero cryptominer and a Gh0st remote access trojan (RAT). The research unveiling these tactics was published on November 12, 2026, following FortiGuard’s initial detection of the activity in early October.
According to the findings, the severity of the ongoing attacks has been rated as high. While the specific number of compromised servers remains undisclosed, the methodology employed in the campaign reveals a systematic approach to exploiting vulnerabilities. The attackers utilized an initial Go payload, equipped with an open-source tool called Naabu, which serves as a port scanner. This tool retrieves ranges of IP addresses from a command server before scanning them for TCP port 1433—the default port for SQL Server. The significance of this is that, by focusing on this particular port, attackers can efficiently identify potentially vulnerable SQL Server instances.
Once the scanning process identifies responsive hosts, the attackers deploy a brute-force mechanism to attempt logins using widely known default usernames, such as "sa" and "admin," in conjunction with an extensive list of over 2,700 passwords. This persistence in trying various combinations aims to breach the defenses of as many servers as possible. Upon successfully logging in, the attackers leverage Transact-SQL (T-SQL) commands on the compromised systems. T-SQL is an extension of SQL tailored for SQL Server, allowing the execution of operating system commands.
The execution of these commands facilitates the activation of xp_cmdshell, a feature that permits running OS-level commands directly. Following this, the malware manages to download or extract an initial loader, which is configured to operate routinely—specifically, set to initiate daily and to reside in the Startup folder. This clever arrangement ensures that the malicious code is reloaded at each server boot.
As the loader executes, it connects to an FTP server to pull down further malicious payloads, systematically registering each compromised server back to the attackers’ backend. This registration process includes critical information such as the server’s public IP address, its geographical location, the Windows edition it runs, processor specifications, memory details, the installation date of the operating system, as well as the user and host names.
The initial malware payload comprises a Monero cryptominer derived from XMRig, which harnesses the server’s processing capabilities to generate cryptocurrency. Uniquely deceptive, this malware masquerades as a Microsoft Edge update to evade detection. It creates scheduled tasks that facilitate the mining process and communicates mining initiation back to the attackers.
Additionally, the campaign deploys a variant of the Gh0st RAT, which is aptly named after a Windows system process to augment its camouflage. Although the command-and-control (C2) server associated with this variant was shut down by the time Fortinet conducted its analysis, researchers meticulously examined the RAT’s coding without executing it. Their scrutiny revealed that this RAT encompasses a suite of functionalities, including keylogging capabilities, data exfiltration, and over 30 control commands. With additional plugins, it is capable of screen captures and remote desktop control, providing the attackers comprehensive access to the compromised systems.
For maintaining persistence within the system, the Gh0st RAT employs various tactics, such as using a Windows service, a scheduled task set to execute every 30 minutes, and a registry Run key, thereby securing its foothold on the server.
The nature of this attack is particularly concerning, as it lacks a definitive endpoint; it is designed to perpetuate its search for additional vulnerable servers as long as the attackers’ base continues to dispatch new address ranges. The implications for organizations relying on Microsoft SQL Server are substantial, emphasizing the critical need for robust password policies and security measures to mitigate such vulnerabilities. As cybersecurity threats continue to evolve, vigilance and proactive defense strategies become more imperative than ever.