Mining
Hackers Exploit Weak Passwords to Deploy Monero Miners and Gh0st RAT via SQL Servers
A recent hacking campaign has been revealed, targeting internet-facing Microsoft SQL Server databases to deploy two malicious payloads: a Monero miner and a remote access trojan (RAT) known as Gh0st RAT. FortiGuard Labs disclosed the operation on November 12, 2026, noting that the attackers primarily exploited weak passwords rather than sophisticated vulnerabilities.
How the Attack Unfolds
The attack begins with reconnaissance, utilizing a tool called Naabu to scan for accessible SQL Server instances. Once identified, the attackers employ a .NET-based brute-force tool that cycles through over 2,700 common passwords until successful login is achieved. After gaining access, they execute malicious T-SQL commands to enable a feature called xp_cmdshell, allowing them to run commands directly on the server's operating system.
Payloads and Their Impact
The first payload is a cryptocurrency miner built on XMRig, disguised under the name MicrosoftEdgeUpdate.exe to evade detection. This miner consumes the victim's CPU resources and connects to various mining pools, including nanopool and kryptex. The second payload, Gh0st RAT, grants the attackers extensive control over the infected machine, supporting over 30 commands for file management, keylogging, screen capture, and credential theft.
Defensive Measures
FortiGuard Labs emphasizes that organizations running SQL Server should implement strong, unique passwords and consider keeping databases off the public internet. Disabling xp_cmdshell can also help mitigate risks. Security teams are advised to monitor for unusual processes, scheduled tasks, and unexpected outbound connections to known mining pools.
Attribution and Infrastructure
The command-and-control infrastructure for this campaign included domains such as server.vietnam852[.]com. Although researchers have not confirmed the number of victims, they noted that the malware exhibited traits suggesting a potential link to Chinese-speaking actors.
FAQ
What types of payloads are being deployed in this hacking campaign?
The hacking campaign deploys two types of payloads: a Monero cryptocurrency miner and a remote access trojan (RAT) known as Gh0st RAT.
How do attackers gain access to SQL Server databases?
Attackers gain access by exploiting weak passwords, using a brute-force tool that cycles through over 2,700 common passwords until they successfully log in.
What is the purpose of the xp_cmdshell feature in SQL Server?
The xp_cmdshell feature allows attackers to run commands directly on the server's operating system after they gain access to the SQL Server.
What defensive measures can organizations take to protect against this type of attack?
Organizations should implement strong, unique passwords, consider keeping databases off the public internet, and disable xp_cmdshell to mitigate risks.
What are the potential impacts of the Gh0st RAT on infected machines?
Gh0st RAT grants attackers extensive control over the infected machine, enabling file management, keylogging, screen capture, and credential theft.