Microsoft SQL Server Instances Targeted with T-SQL Based Malware Delivery Leveraging Brute-Force Attacks and Remote Loaders
A campaign abusing exposed Microsoft SQL Server instances for malware delivery has been analyzed. Attackers use a UPX-packed Go binary with Naabu scanner to identify reachable servers over TCP port 1433, then brute-force MSSQL logins with a predefined credential list. Successful logins execute T-SQL commands enabling xp_cmdshell to download malicious loaders that pull additional payloads from FTP servers. Notably, payloads include a XMRig Monero miner disguised as MicrosoftEdgeUpdate.exe and a Gh0st RAT (winlogon.exe) providing remote control capabilities. Fortinet's IPS, Web Filtering, and AntiVirus services currently detect and block this campaign's activities and payloads, mitigating its impact on protected networks. This campaign underscores the risk of exposed MSSQL servers and the abuse of legitimate SQL functionality for persistence and malware deployment.
Linha do tempo
-
Microsoft SQL Server Instances Targeted with T-SQL Based Malware Delivery Leveraging Brute-Force Attacks and Remote Loaders
ler a análise desta fonte ocultar
A campaign abusing exposed Microsoft SQL Server instances for malware delivery has been analyzed. Attackers use a UPX-packed Go binary with Naabu scanner to identify reachable servers over TCP port 1433, then brute-force MSSQL logins with a predefined credential list. Successful logins execute T-SQL commands enabling xp_cmdshell to download malicious loaders that pull additional payloads from FTP servers. Notably, payloads include a XMRig Monero miner disguised as MicrosoftEdgeUpdate.exe and a Gh0st RAT (winlogon.exe) providing remote control capabilities. Fortinet's IPS, Web Filtering, and AntiVirus services currently detect and block this campaign's activities and payloads, mitigating its impact on protected networks. This campaign underscores the risk of exposed MSSQL servers and the abuse of legitimate SQL functionality for persistence and malware deployment.