Cryptominer and Gh0st RAT Deployed via Brute Force on Internet-Facing Microsoft SQL Servers
FortiGuard Labs uncovered a high-severity campaign exploiting weak passwords on internet-facing Microsoft SQL Server instances. Attackers use an initial Go-based payload embedding the open-source Naabu port scanner to discover vulnerable SQL Servers listening on TCP port 1433. They then brute force logins with over 2700 passwords targeting usernames like 'sa' and 'admin'. Upon access, the attackers enable xp_cmdshell and execute Transact-SQL commands to download and persist a loader that installs a Monero cryptominer disguised as a Microsoft Edge update and a sophisticated Gh0st RAT variant. The RAT supports extensive remote control capabilities including keylogging, data theft, screen capture, and evasion techniques. Persistence mechanisms leverage scheduled tasks, registry keys, and services. The campaign scans IP ranges continuously as long as the attacker's infrastructure responds.
Linha do tempo
-
Cryptominer and Gh0st RAT Deployed via Brute Force on Internet-Facing Microsoft SQL Servers
ler a análise desta fonte ocultar
FortiGuard Labs uncovered a high-severity campaign exploiting weak passwords on internet-facing Microsoft SQL Server instances. Attackers use an initial Go-based payload embedding the open-source Naabu port scanner to discover vulnerable SQL Servers listening on TCP port 1433. They then brute force logins with over 2700 passwords targeting usernames like 'sa' and 'admin'. Upon access, the attackers enable xp_cmdshell and execute Transact-SQL commands to download and persist a loader that installs a Monero cryptominer disguised as a Microsoft Edge update and a sophisticated Gh0st RAT variant. The RAT supports extensive remote control capabilities including keylogging, data theft, screen capture, and evasion techniques. Persistence mechanisms leverage scheduled tasks, registry keys, and services. The campaign scans IP ranges continuously as long as the attacker's infrastructure responds.