Sophisticated Malware Campaign Exploits Microsoft SQL Server Vulnerabilities to Deploy Miners and RATs

A persistent and highly calculated cyberattack campaign has been identified targeting internet-facing Microsoft SQL Server (MSSQL) instances. By leveraging weak administrative credentials, threat actors have successfully compromised a significant number of servers, using them as a launchpad to deploy both Monero cryptominers and a feature-rich remote access trojan (RAT). The campaign, which was first detected by researchers at FortiGuard Labs in early October 2026, highlights the ongoing dangers posed by exposed database infrastructure and the critical necessity of robust credential management.

According to a detailed technical analysis published by Fortinet on November 12, the campaign has been categorized as high severity. While the specific scale of the infection—the total number of compromised servers—remains unknown, the methodology employed by the attackers suggests a highly automated and scalable operation. As of the time of the report, the identity of the threat actors behind this operation remains shrouded in mystery, though their sophisticated use of multi-stage payloads and persistence mechanisms points to a coordinated effort by a technically proficient group.

Automated Reconnaissance and Brute-Force Tactics

The lifecycle of these attacks begins with a Go-based payload that incorporates the open-source Naabu port scanner. This tool is designed for efficiency; it receives an IP range from the attackers’ centralized command infrastructure, systematically scans that range for TCP port 1433—the default listening port for Microsoft SQL Server—and identifies hosts that respond. Once a target is successfully identified and flagged, the scanner reports the data back to the attacker’s server, receives a new IP range, and continues the cycle indefinitely. This creates a relentless, automated search loop that keeps the attackers constantly supplied with new potential victims.

Once a target server is confirmed to be reachable, the attackers initiate a brute-force phase. Using a specialized tool, the campaign attempts to authenticate against the identified SQL instances using a broad dictionary of more than 2,700 common passwords, combined with ubiquitous administrative usernames such as "sa" (system administrator) and "admin." The sheer volume of these attempts suggests that the attackers are relying on the prevalence of poor security hygiene among database administrators, specifically the failure to enforce complex password policies or disable default, high-privilege accounts.

Weaponizing Transact-SQL for System Compromise

The transition from unauthorized access to full system control is achieved through the abuse of Transact-SQL (T-SQL). As an extension of the standard SQL database language, T-SQL provides powerful programming features that allow for the management of the SQL Server environment. However, when weaponized, these features provide a direct bridge between the database layer and the underlying Windows operating system.

Upon gaining entry, the malware executes T-SQL commands to enable the xp_cmdshell feature. In a secure environment, this procedure is typically disabled by default because it allows the execution of arbitrary operating system commands through the SQL Server service account. By enabling it, the attackers effectively bypass the traditional boundaries of the database, allowing them to download and execute malicious payloads directly on the host machine.

The initial loader downloaded via this method is configured for persistence, ensuring the malware survives system reboots. The attackers achieve this by scheduling the loader to run as a daily task and placing a copy of the executable in the Windows Startup folder. Once established, the loader acts as an agent that pulls additional, more advanced malware from a remote FTP server. Furthermore, the loader performs a detailed reconnaissance of the host, exfiltrating critical system information to the attackers’ backend, including the public IP address, geographic location, Windows version, processor and memory specifications, system installation time, and the specific host and user names.

Cryptomining and Remote Access Capabilities

The secondary payloads deployed by this campaign serve two distinct purposes: financial gain through resource theft and long-term espionage through remote control.

One of the primary payloads is a Monero cryptominer derived from the well-known XMRig software. To avoid detection by system administrators, the attackers have carefully masked the miner by naming the process to mimic a legitimate Microsoft Edge update. This deceptive naming convention is applied to both the process and the scheduled tasks created by the malware, a common tactic designed to blend in with normal system activity. The miner immediately begins consuming the server’s processor resources to generate cryptocurrency for the attackers, sending status reports back to the command-and-control (C2) server once mining operations are underway.

The second, perhaps more dangerous, payload is a variant of the Gh0st RAT. Much like the cryptominer, the RAT is disguised as a legitimate Windows system process to evade casual scrutiny. Although the primary C2 server for this RAT had been taken offline by the time Fortinet researchers conducted their analysis, the static examination of the code revealed a highly capable and invasive tool.

The Gh0st RAT variant is equipped with over 30 distinct control commands, enabling a wide array of malicious actions. Beyond standard data theft and keylogging capabilities, the RAT includes plugins that allow the attackers to perform screen captures and initiate remote desktop sessions. Its defensive evasion capabilities are particularly notable; the RAT is designed to monitor for the presence of 78 different security products by checking their process names. If a security tool is detected, the RAT can respond accordingly, or it can be used to clear event logs to mask its tracks. Additionally, the malware contains modules specifically designed to steal sensitive data from the QQ messaging application, indicating that the attackers may be targeting specific regions or user bases.

To ensure it remains on the system even if the primary loader is disrupted, the RAT utilizes multiple persistence mechanisms. It installs itself via a Windows Registry "Run" key, registers as a Windows service, and establishes a scheduled task that executes every 30 minutes.

The Fortinet report serves as a stark reminder of the risks associated with exposing database management systems directly to the internet. By failing to restrict access to port 1433, utilizing weak or default passwords, and failing to disable dangerous features like xp_cmdshell, organizations are essentially leaving the door open for automated campaigns to compromise their infrastructure. As this campaign demonstrates, the attackers’ search loop has no built-in termination condition; as long as the infrastructure exists and remains vulnerable, the automated scanning and exploitation process will continue to cycle through address ranges, seeking out the next insecure host to convert into a source of illicit revenue or a platform for corporate espionage.