Brute-force attacks on exposed Microsoft SQL Servers deploy XMRig Monero miner and Gh0st RAT via xp_cmdshell
Matéria consolidada. Reúne 3 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 3 fontes trouxeram em 13/11/2026 00:02; os links antigos trazem para cá.
Fontes: hackread.com ↗ infosecurity-magazine.com ↗ feeds.fortinet.com ↗
FortiGuard Labs (Fortinet) analyzed a campaign that brute-forces internet-exposed Microsoft SQL Server instances and uses them to deliver a XMRig Monero miner and a Gh0st RAT variant. The first step is a UPX-packed Go binary that embeds the open-source Naabu scanner to find servers listening on TCP port 1433 (feeds.fortinet.com, infosecurity-magazine.com). Once a login succeeds, the attackers enable xp_cmdshell and run T-SQL commands to download loaders. The campaign began in October 2026 according to hackread.com, which is the only source giving a start date. Fortinet says its IPS, Web Filtering and AntiVirus services detect and block the activity and payloads (feeds.fortinet.com). Sources stress that the campaign abuses weak or default credentials and legacy misconfigurations, not a new vulnerability (hackread.com). No CVE is cited.
Detalhes técnicos
- Discovery: the Go-based initial payload embeds Naabu and scans IP ranges for TCP 1433. Scanning continues as long as the attacker's infrastructure responds (infosecurity-magazine.com).
- Brute force: the payload uses a predefined credential list (feeds.fortinet.com) of over 2,700 passwords, aimed at usernames such as 'sa' and 'admin' (infosecurity-magazine.com, hackread.com).
- Execution: after a successful login, the attackers enable xp_cmdshell and run Transact-SQL commands to execute Windows commands. These commands download a loader, which pulls further payloads from FTP servers (feeds.fortinet.com, infosecurity-magazine.com).
- Payloads: a XMRig Monero miner disguised as MicrosoftEdgeUpdate.exe, and a Gh0st RAT variant named winlogon.exe (feeds.fortinet.com, hackread.com).
- Gh0st RAT capabilities: remote control, keylogging, data theft, screen capture and evasion techniques (infosecurity-magazine.com, hackread.com).
- Persistence: scheduled tasks, registry keys and services (infosecurity-magazine.com).
Remediação
- Remove direct internet exposure of SQL Server, especially TCP 1433 (hackread.com).
- Enforce strong, unique credentials and restrict administrative access (hackread.com).
- Disable xp_cmdshell where possible (hackread.com).
- Monitor for suspicious activity and adopt modern privileged access management practices (hackread.com).
- Fortinet customers are covered by IPS, Web Filtering and AntiVirus signatures (feeds.fortinet.com).
- Hunt for the masquerading file names MicrosoftEdgeUpdate.exe and winlogon.exe outside their legitimate contexts, and for unexpected scheduled tasks, registry run keys and services. This hunting advice is the desk's inference from the reported persistence methods, not a source recommendation.
Linha do tempo
-
Hackers abuse exposed Microsoft SQL Servers via brute force to deploy Monero miner and Gh0st RAT
ler a análise desta fonte ocultar
Fortinet's FortiGuard Labs uncovered a campaign beginning October 2026 targeting internet-exposed Microsoft SQL Server instances with weak or default credentials via brute-force attacks. Attackers exploit administrative features of SQL Server, specifically enabling xp_cmdshell, to execute Windows commands and deploy malicious payloads including a Monero cryptocurrency miner disguised as MicrosoftEdgeUpdate.exe and a Gh0st RAT variant named winlogon.exe. The Gh0st RAT supports remote access, keylogging, screen capture, and persistence mechanisms. The attackers use open-source tools like Naabu for scanning and attempt over 2,700 password guesses against common admin accounts. This campaign highlights risks from exposed privileged credentials and legacy misconfigurations rather than new vulnerabilities. Mitigations emphasize removing internet exposure of SQL Server, enforcing strong unique credentials, restricting admin access, disabling xp_cmdshell when possible, monitoring for suspicious activity, and adopting modern privileged access management practices.
-
Cryptominer and Gh0st RAT Deployed via Brute Force on Internet-Facing Microsoft SQL Servers
ler a análise desta fonte ocultar
FortiGuard Labs uncovered a high-severity campaign exploiting weak passwords on internet-facing Microsoft SQL Server instances. Attackers use an initial Go-based payload embedding the open-source Naabu port scanner to discover vulnerable SQL Servers listening on TCP port 1433. They then brute force logins with over 2700 passwords targeting usernames like 'sa' and 'admin'. Upon access, the attackers enable xp_cmdshell and execute Transact-SQL commands to download and persist a loader that installs a Monero cryptominer disguised as a Microsoft Edge update and a sophisticated Gh0st RAT variant. The RAT supports extensive remote control capabilities including keylogging, data theft, screen capture, and evasion techniques. Persistence mechanisms leverage scheduled tasks, registry keys, and services. The campaign scans IP ranges continuously as long as the attacker's infrastructure responds.
-
Microsoft SQL Server Instances Targeted with T-SQL Based Malware Delivery Leveraging Brute-Force Attacks and Remote Loaders
ler a análise desta fonte ocultar
A campaign abusing exposed Microsoft SQL Server instances for malware delivery has been analyzed. Attackers use a UPX-packed Go binary with Naabu scanner to identify reachable servers over TCP port 1433, then brute-force MSSQL logins with a predefined credential list. Successful logins execute T-SQL commands enabling xp_cmdshell to download malicious loaders that pull additional payloads from FTP servers. Notably, payloads include a XMRig Monero miner disguised as MicrosoftEdgeUpdate.exe and a Gh0st RAT (winlogon.exe) providing remote control capabilities. Fortinet's IPS, Web Filtering, and AntiVirus services currently detect and block this campaign's activities and payloads, mitigating its impact on protected networks. This campaign underscores the risk of exposed MSSQL servers and the abuse of legitimate SQL functionality for persistence and malware deployment.