Hackers abuse exposed Microsoft SQL Servers via brute force to deploy Monero miner and Gh0st RAT
Fortinet's FortiGuard Labs uncovered a campaign beginning October 2026 targeting internet-exposed Microsoft SQL Server instances with weak or default credentials via brute-force attacks. Attackers exploit administrative features of SQL Server, specifically enabling xp_cmdshell, to execute Windows commands and deploy malicious payloads including a Monero cryptocurrency miner disguised as MicrosoftEdgeUpdate.exe and a Gh0st RAT variant named winlogon.exe. The Gh0st RAT supports remote access, keylogging, screen capture, and persistence mechanisms. The attackers use open-source tools like Naabu for scanning and attempt over 2,700 password guesses against common admin accounts. This campaign highlights risks from exposed privileged credentials and legacy misconfigurations rather than new vulnerabilities. Mitigations emphasize removing internet exposure of SQL Server, enforcing strong unique credentials, restricting admin access, disabling xp_cmdshell when possible, monitoring for suspicious activity, and adopting modern privileged access management practices.
Linha do tempo
-
Hackers abuse exposed Microsoft SQL Servers via brute force to deploy Monero miner and Gh0st RAT
ler a análise desta fonte ocultar
Fortinet's FortiGuard Labs uncovered a campaign beginning October 2026 targeting internet-exposed Microsoft SQL Server instances with weak or default credentials via brute-force attacks. Attackers exploit administrative features of SQL Server, specifically enabling xp_cmdshell, to execute Windows commands and deploy malicious payloads including a Monero cryptocurrency miner disguised as MicrosoftEdgeUpdate.exe and a Gh0st RAT variant named winlogon.exe. The Gh0st RAT supports remote access, keylogging, screen capture, and persistence mechanisms. The attackers use open-source tools like Naabu for scanning and attempt over 2,700 password guesses against common admin accounts. This campaign highlights risks from exposed privileged credentials and legacy misconfigurations rather than new vulnerabilities. Mitigations emphasize removing internet exposure of SQL Server, enforcing strong unique credentials, restricting admin access, disabling xp_cmdshell when possible, monitoring for suspicious activity, and adopting modern privileged access management practices.